Pfsense Dns Configuration: Setup, Resolver, And Best Practices

Configuring domain name resolution correctly on your firewall dictates how fast, secure, and reliable your entire local network operates. Setting up pfSense domain name resolution means choosing between native recursive lookup and forwarding queries upstream, managing local DHCP integration, and hardening privacy against leaks.

Getting this infrastructure right prevents common bottlenecks like slow page loads, local hostname resolution failures, and broken Active Directory integrations. Let's look at how to build a resilient name resolution setup on your pfSense firewall from scratch.

Resolver Versus Forwarder: Choosing the Right Engine

pfSense includes two distinct services for handling domain queries: the DNS Resolver (powered by Unbound) and the DNS Forwarder (powered by dnsmasq). You can only run one active service on port 53 at a time, and choosing the right one sets the foundation for your network.

The DNS Resolver is the default choice for modern deployments. In pure resolver mode, it queries root name servers directly, performing recursive lookups without relying on third parties like Google or Cloudflare. This approach maximizes privacy because your ISP or public resolvers don't see every domain your network visits. It also natively validates DNSSEC, ensuring responses haven't been maliciously altered in transit.

[Client Device] ──► (Port 53) ──► [pfSense Unbound Resolver] ──► [Root Name Servers]

The DNS Forwarder, conversely, accepts client requests and passes them off to external upstream servers (such as 1.1.1.1 or 8.8.8.8). While you can run the DNS Resolver in forwarding mode (checking the "Enable Forwarding Mode" box), using dnsmasq is usually reserved for legacy environments or complex multi-WAN setups that require parallel queries across multiple uplinks. For most home labs and enterprise networks, stick with the Unbound Resolver.

Step-by-Step Configuration of the Unbound Resolver

Setting up the DNS Resolver properly involves configuring basic bindings, security extensions, and upstream forwarding if required by your corporate policy.

1. Navigate to Services > DNS Resolver in the pfSense web interface.
2. Check the box to Enable the DNS Resolver.
3. Set the Listen Port to the standard 53.
4. Select your active network interfaces (such as LAN and any VLANs) under Network Interfaces. Leave WAN unchecked to prevent external systems from querying your internal resolver.
5. Choose your Outgoing Network Interfaces (typically WAN), ensuring local queries egress through the correct gateway.
6. Ensure DNSSEC remains enabled to cryptographically verify domain authenticity.
7. Click Save and apply changes.

If your network policy or local ISP demands that you use specific upstream servers, check Enable Forwarding Mode (labeled as DNS Query Forwarding in some versions). When enabled, Unbound stops querying root servers directly and instead sends requests to the upstream IP addresses defined under System > General Setup.

Local Hostnames and DHCP Integration

A major advantage of running Unbound on your firewall is seamless local name resolution. Instead of managing static entries manually for every device, you can configure pfSense to automatically register DHCP clients.

To pull local hostnames into your resolver:

• Go to Services > DNS Resolver.
• Scroll down to the DHCP Registration section.
• Check Register DHCP lease in DNS resolver. This lets your local machines resolve each other by hostname (e.g., nas.local or workstation.lan).
• Check Register DHCP static mappings to ensure reserved IP addresses get permanent local DNS records automatically.

When devices don't use the firewall's DHCP server, you can create manual entries using Host Overrides. Scroll to the bottom of the DNS Resolver settings page, click Add under Host Overrides, and enter the hostname, domain, and target IP address. This is critical for managing local servers, hypervisors, and network switches.

Encrypting Traffic with DNS over TLS (DoT)

Unencrypted queries sent to public servers are visible to anyone monitoring your internet connection. You can secure outbound traffic by enabling DNS over TLS (DoT).

To route outbound requests securely:

1. Go to System > General Setup.
2. Define your upstream DNS servers (such as Quad9 at 9.9.9.9 or Cloudflare at 1.1.1.1) and select a matching gateway.
3. Return to Services > DNS Resolver and check Use SSL/TLS for outgoing DNS Queries to Forwarding Servers.
4. Save and apply changes.

Your firewall now encrypts all outbound traffic to those upstream providers using port 853, preventing local packet inspection and man-in-the-middle manipulation.

Common Configuration Pitfalls

Even experienced administrators run into snags when tweaking name resolution settings. Watch out for these frequent missteps:

• Port 53 Conflicts: If you try to enable the DNS Forwarder while the DNS Resolver is running, the service will fail to start because both attempt to bind to port 53. Always disable one before starting the other.
• Incorrect System Time: DNSSEC relies heavily on accurate timestamps to verify cryptographic signatures. If your firewall's clock is out of sync due to an incorrect NTP configuration, DNSSEC validation fails completely, breaking internet access for your entire network.
• Exposing the Resolver to WAN: Accidentally checking the WAN interface under Network Interfaces turns your firewall into an open resolver, inviting DDoS amplification attacks from malicious actors across the public internet.

Frequently Asked Questions

Why is my local network failing to resolve domain names after enabling the resolver?

Check Status > System Logs under the Resolver tab to spot syntax errors or port binding conflicts. Also confirm that your client devices are explicitly pointed to the LAN IP address of your pfSense firewall as their primary name server, rather than pointing directly to public IPs.

Should I use the resolver mode or forwarding mode for better performance?

Pure resolver mode caches aggressively and cuts out intermediary hops, but initial lookups for cold domains might feel marginally slower while Unbound traverses the root servers. Forwarding mode replies faster if your upstream provider has a massive edge cache, but you sacrifice direct privacy.

How do I handle internal Active Directory domains alongside pfSense?

If you run a Windows Domain Controller, configure a Domain Override in pfSense. Point your internal Active Directory domain (e.g., corp.local) directly to the internal IP address of your Windows DNS server, allowing pfSense to delegate local directory queries properly while handling standard public traffic.

Can I block ads directly through the pfSense resolver?

Yes. Many administrators install packages like pfBlockerNG, which hooks directly into the Unbound resolver to sinkhole malicious domains, ad servers, and tracking networks before they ever reach client devices on your network. Refer to the Netgate Documentation for official software guidelines.