question about unbound send query to upstream with tls in freebsd14.2 ?

[fff2024g]

Dear all :
i have build a unbound dns server in the jail with freebsd14.2. now when i active unbound tls upstream function. this dns server will not work. do you know how to fix it ? thanks. below was my configuration file.

# cat /usr/local/etc/unbound/unbound.conf
server:
    interface: 300:96e0:94a9:2a58::9   
    interface: 10.0.0.9

    access-control: 0.0.0.0/0 refuse
    access-control: ::/0 refuse
    access-control: 127.0.0.1 allow
    access-control: ::1 allow
    access-control: 300:96e0:94a9:2a58::0/64 allow
    access-control: 10.0.0.0/24 allow

    logfile: "/var/log/unbound/unbound.log"
    use-syslog: no
    log-queries: yes
    verbosity: 1
    tls-cert-bundle: "/etc/ssl/cert.pem"
    root-hints: "/usr/local/etc/unbound/named.cache"
    auto-trust-anchor-file: "/usr/local/etc/unbound/root.key"
    module-config: "dns64 iterator"
  
forward-zone:
     name: "."
    forward-tls-upstream: yes
    forward-first: yes
   forward-addr: 2606:4700:4700::1111@853#one.one.one.one
   forward-addr: 2606:4700:4700::1001@853#one.one.one.one

cat /etc/rc.conf
nameserver 300:96e0:94a9:2a58::9
nameserver 10.0.0.9

ifconfig vnet0:

vnet0: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
    options=8<VLAN_MTU>
     inet 10.0.0.9 netmask 0xffffff00 broadcast 10.0.0.255
    inet6 fe80::cf:32ff:fe20:290b%vnet0 prefixlen 64 scopeid 0xb
    inet6 300:96e0:94a9:2a58::9 prefixlen 64

please help me . thanks.