@mattpdx86 You mentioned the server is in VMWare Fusion, is it NAT? or is it on the same network as the host (bridge mode)? Where is the Windows 10 device, is it also in VMWare? Maybe you mentioned it but I missed it if you did...
It's been a long time since I had to setup Fusion (people at work largely switched to Parallels) and I am not a MAC person... but I think the default is to NAT the VM. Bridged mode would give the VM an IP in the same network as the host is in, but NAT has a software firewall that may be an issue here if the server is natted. Same for if it's the Windows 10 machine if it is the natted one.

If they are on the same network, then PFSense has nothing to do with it at least in terms of firewall. It is best to have the Server 2012 box handle DHCP and DNS, and give out via DHCP, ONLY the IP of the 2012 box for DNS. Have the 2012 server then forward DNS to the LAN IP of PFSense, and let PFSense take it from there for any address that is NOT in your internal network. Otherwise, you need a host override for the IP of the server AND a host override for the domain name, pointing it to the server IP. If you have more than one server, point the domain override at the master roles holder (or the PDC Emulator role holder if the roles are split amongst several DCs). When joining a domain, the desktop is looking for the DOMAIN, not the server.