Mailcow enables a recursive DNS server by default. Disable it to avoid problems on a protected server.
Add this block to the end of /opt/mailcow-dockerized/data/conf/unbound/unbound.conf:
forward-zone:
name: "."
forward-addr: 1.1.1.1
forward-addr: 8.8.8.8