I think I tracked it down. The SRV query appears to belong to the repository agent (pfSense-repoc). It's trying to find the closest or most available update mirror. I ran the following: pkg -d update The results showed pfSense stuck in a loop checking for system updates. Netgate's repository servers (pfsense-plus-pkg01 and pkg00) were actively rejecting your firewall's built-in client certificate at the application layer, throwing an HTTP 400 Bad Request. Because of this failure, the pkg tool mistakenly attempted to resume partial downloads using bad byte ranges, causing it to endlessly cycle between mirrors and throw erratic errors. Additionally, this update routine caused the firewall to query netgate.com as a relative name, resulting in the netgate.com.foo.org that I saw in the BIND logs. I resolved this as follows: rm -rf /var/db/pkg/repos/* Wipe out the corrupted metadata cache and clear the broken partial download states that were driving the infinite loop. pfSense-upgrade -cc Clean the internal upgrade utility cache. This forced the firewall to dump the stale SSL session tokens and request a fresh mutual TLS (mTLS) authentication challenge from Netgate's registration backend. -- Best regards

I figured it out - I should not put my authoritative server under the domain override section because unbound put it in a forward zone and expects a dns resolver. Instead, I switched to a stub zone under custom configuration, which requires an authoritative dns server and unbound will perform recursive lookup itself.

@bingo600 That is pretty slick!

Linked issue: https://redmine.pfsense.org/issues/10445

@gertjan said in Bind - Setup pfSense as slave DNS server: your DNS zone has to be fully IPv6 and IPv4 Don't agree with this.. While sure if you have IPv6 then yeah be nice to do that.. But it sure doesn't have to do anything IPv6.. And while I agree you should do dnssec - again not a requirement.. You do not have to setup dnssec - and people using dnssec will still resolve you. Unless you try setup dnssec and you mess it up.. Then yeah if your dnssec fails you won't resolve. He is trying to show you that yes it gets complicated very quickly.. But when it comes down to setting up a slave. You tell your master what IP are you slaves, and you setup the zones on your slave and tell them the IP of the master. But he makes a good point about your PTR.. Can you even set that either of your NSers IPs? That really should be set.. Is where you running pfsense even a static IP? What are you going to do if someone attacks your dns? What are you going to do if someone tries to use your NSers for a amplification attack and you didn't secure for that? What your using for NS should not be recursive.. An authoritative NS should not do queries for other clients. They only should answer for the domains they are authoritative for..

DNSBL will block domains, it cannot block based on a URL as it is a DNS based blocker.