unbound (till and including version 1.8.0) has no support for SNI (Server Name Indication) on DoT (DNS over TLS) upstream queries and thus produces on DoT queries to SNI hosts this error:
outnettcp got tcp error -1
In order to provide SNI support on DoT a patch is being provided by unbound master