DNS resolver and SOA records

kevdog

Hi I'm using the Unbound resolver within pfsense. I'm having an issue with querying soa records for a domain (actually running servers which use soa lookups).

My unbound resolver has the following:
Enable DNS resolver
Listen Port 53
SSL/TLS certificate
SSL/TLS Listen Port
Network Interfaces ALL
Outgoing Network Interfaces ALL
Enable Forwarding Mode
Use SSL/TLS for outgoing DNS Queries to Forwarding Servers

Forwarding DNS servers are 1.1.1.2 1.0.0.2 9.9.9.9 149.112.112.112

I use CF as my DNS registrar and have a test domain -- traefik.xxxx.com

Within LAN (behind pfsense) if I query I get the following:

#nslookup -type=soa traefik.xxxxx.com 1.1.1.1 
Server:		1.1.1.1
Address:	1.1.1.1#53

*** Can't find traefik.xxxxx.com: No answer

However if I'm I'm not behind pfsense (tether off phone for example):

#nslookup -type=soa traefik.xxxxx.com 1.1.1.1 
Server:		1.1.1.1
Address:	1.1.1.1#53

Non-authoritative answer:
*** Can't find traefik.xxxxx.com: No answer

Authoritative answers can be found from:
xxxxxx.com
	origin = connie.ns.cloudflare.com
	mail addr = dns.cloudflare.com
	serial = 2035659851
	refresh = 10000
	retry = 2400
	expire = 604800
	minimum = 3600

So it doesn't seem I'm able to query SOA records likely because I don't have something configured correctly. Any help on this issue would be helpful.