Hi. There's a feature not documented in unbound.conf(5), that auth-zone can talk to DNS primary on nondefault port. Its 'master' sub-clause accepts an '@PORT' option, for example:
auth-zone:
name: "domain.home"
master: 10.10.10.1@5353
allow-notify: 10.10.10.1
Two source code sections show support for port number: authzone.h:struct auth_master{}; and authzone.c: addr_matches_master(). And I can confirm transfers are successful from NSD primary to UNBOUND secondary.
Perhaps someone can verify and update unbound.conf(5). Thanks.
unbound.conf.5.in.diff.txt