Unexpected resolver behavior

OGsadpanda

Just a n00b following guides so I'm sure this will be a dumb question - I hate to ask but I'm stuck.

First setup pf a couple years ago using nguvu and lawrence sys guides. This has been working well so I decided to add pfblocker to the mix and followed zenarmor guide

seems like pfblockerng is working as expected except for one thing - I think DNS is still being resolved instead of pfblocker sink holed

Expected behavior per zenarmor guide:

$ nslookup dnsbltest.com
Server: pfsense.home.arpa
Address:  10.1.1.1

DNS request timed out.

Observed behavior

$ nslookup dnsbltest.com
Server:		127.0.0.53
Address:	127.0.0.53#53

Non-authoritative answer:
Name:	dnsbltest.com
Address: 46.8.8.100

per original setup resolver

Resolver - enabled
SSL/TLS - unchecked
Interfaces - Lan and select vlans
Outgoing - vpnwan
Strict outgoing Binding - unchecked
DNSSEC -checked
Python - checked
DHCP Registration - unchecked
Static DHCP - checked
custom options: local-data: "local.lan. 10800 IN SOA pfsense.local.lan. root.local.lan. 1 3600 1200 604800 10800"

and DNS forwarder:

Enabled
no options above listen port checked
listen port 5335
interface: localhost
strict binding - checked

I can ping/brows 10.1.1.1

thanks.