Comment 6 for bug 988513

So unbound since 1.5.7-2 (which is in xenial and on) no longer ships a /etc/default/unbound by default. It would appear, based upon the change in that release:

+ RESOLVCONF_FORWARDERS
+
+ This variable controlled whether or not the upstream nameservers
+ supplied by resolvconf were configured into the running Unbound instance
+ with the "unbound-control forward" command, via a resolvconf update.d
+ hook.
+
+ This mechanism still exists, but the variable controlling it has been
+ removed. Instead, add or remove the executable bit from the
+ /etc/resolvconf/update.d/unbound file to enable or disable the hook.

And by default:

        install -m 0644 debian/resolvconf debian/unbound/etc/resolvconf/update.d/unbound

So I think it's non-executable (and thus not executed) by default. For the purposes of this bug, I feel like it's fixed now. However, I think we cannot change the default behavior in existing releases. Can you confirm that c#5's statement does work for you?