Assuming you are logged in to the server running unbound, are the ns for .it reachable? Do all .com domains work and no .org?

Can you run dig +trace on a domain that doesn’t work