Yes, unbound is the Forwarder for the SBS/AD-Domain. And no, the problem is pfsense itself - it can't resolve domain names of the AD-domain internally. As said - it works with dnsmasq but not with unbound and technically the same settings.
The digs
AD-Domain
dig @192.168.2.223 orca.mb-mw.local A
; <<>> DiG 9.10.6 <<>> @192.168.2.223 orca.mb-mw.local A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1761
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
;; QUESTION SECTION:
;orca.mb-mw.local. IN A
;; ANSWER SECTION:
orca.mb-mw.local. 1200 IN A 192.168.2.225
;; Query time: 0 msec
;; SERVER: 192.168.2.223#53(192.168.2.223)
;; WHEN: Fri Sep 01 08:53:09 Mitteleuropõische Sommerzeit 2017
;; MSG SIZE rcvd: 61
pfsense CARP
dig @192.168.2.202 orca.mb-mw.local A
; <<>> DiG 9.10.6 <<>> @192.168.2.202 orca.mb-mw.local A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55831
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;orca.mb-mw.local. IN A
;; ANSWER SECTION:
orca.mb-mw.local. 819 IN A 192.168.2.225
;; Query time: 0 msec
;; SERVER: 192.168.2.202#53(192.168.2.202)
;; WHEN: Fri Sep 01 08:53:01 Mitteleuropõische Sommerzeit 2017
;; MSG SIZE rcvd: 61
nslookup
nslookup orca.mb-mw.local
Server: 192.168.2.223
Address: 192.168.2.223#53
Name: orca.mb-mw.local
Address: 192.168.2.225
