Quintin:
No outbound filters, this is my config:
If I stop tor then "dig @127.0.0.1 google.com" works 100%. It's seems like the pattern is that when tor traffic builds up so do DNS failures. And then my dig @127.0.0.1 only succeeds about 0.1% of the time. At this stage large amounts these errors start appearing:
Do you reach your server's conntrack limit?
https://stackoverflow.com/questions/6240951/sendto-operation-not-permitted-n...
(you didn't say anything about unbound's config)