Changing DNS Servers

Tamaz

I'm using the DNS Resolver in pfSense so I can do blocking at the DNS level. I've been using 1.1.1.1 and 1.0.0.1 as the pfSense DNS servers. I also set these up on my modem since there is one subnet that is not behind the pfSense firewall. Until now, everything's been working fine.

Today, I tried to switch over to CloudFlare's new Family DNS, 1.1.1.3 and 1.0.0.3, for blocking malicious sites and adult content. I made the switch on my modem and that seems to be working fine for the non-pfSense subnet.

I also made the switch in:

pfSense -> General Setup -> DNS Server Settings
Services -> DNS Resolver -> Custom Options

My DNS Resolver Custom Options now look like this:

server:
forward-zone:
name: "."
forward-ssl-upstream: yes
forward-addr: 1.1.1.3@853
forward-addr: 1.0.0.3@853
server:include: /var/unbound/pfb_dnsbl.*conf

However, I am still able to successfully do nslookup on sites that CloudFlare's DNS blocks (ie, nslookup badsite is successful, while nslookup badsite 1.1.1.3 fails). Since specifying 1.1.1.3 is the correct behavior, I suspect there's something wrong with my setup. I've tried doing ipconfig /flushdns on my computer and did a complete reboot of pfSense after simply restarting the DNS Resolver didn't do anything.

Are there any more places in pfSense that need to be updated to use the new DNS?

Alekceu16

System\General Setup
Check option "Disable DNS Forwarder"

Tamaz

@Alekceu16 Thank you for your response. I did not have that option checked before, but unfortunately after checking it, nothing seems to have changed.

Bob.Dig

@Tamaz You have to Enable Forwarding Mode (DNS Query Forwarding) in the resolver first.

Alekceu16

1.0.0.3 not support DoT
https://community.cloudflare.com/t/community-tip-best-practices-for-1-1-1-1-for-families/160496

Alekceu16

So it works
forward-zone:
name: "."
forward-first: yes
#forward-tls-upstream: yes
forward-addr: 1.1.1.3@53
forward-addr: 1.0.0.3@53

Tamaz

@Alekceu16 This solved it! Thank you so much!

Tamaz

@Bob-Dig Thanks for the input! Ended up being because 1.1.1.3 doesn't support DoT yet.