You right! There was something wrong with Unbound DNS (maybe private-address 127.0.0.1/8).
Switch to Dnsmasq working good!
Another question: do i need "Modify Spam Level" and "Modify Spam Subject" action objects in rules? What are they used for? Bayesian autolearn?