Strangely enough DNSViz thinks everything is A-OK: dsm.desterradum.com | DNSViz
Wait, not that strange: DNSSEC Analyzer also marks things with a red cross if DNSSEC is not available, even though that isn't an error per se: it's just less safe than with DNSSEC, but shouldn't hamper with resolving the hostname.
There aren't much hits on the Unbound error "NSEC RRset for the referral proved not a delegation point".. I see @_az had this error back in 2017. Maybe he knows how he dealt with this? In this case it might perhaps be due to the NSEC resource records for both the FQDN as wel as the wildcard? I dunno.. Google fails me with this error.