DNS forwarder Domain Controller -> Pfsense

[IrixOS]

Hi,

For security purpose I want my domain controller who also is a DNS server to resolve only internal names and to forward external queries to pfsense.
I have configured the forwarder as shown in the image and it still uses its local windows dns server to process the request (www.wikipedia.org).

I don't know what causes this behavior. It shouldn't because the firewalls ip address is validated as shown in the image. Doesn't make sense.
When doing nslookup www.wikipedia org from a non-domain windows 10 client it points to the firewall which is the expected behavior.

Does someone have an idea, I might have overlooked something I don't know.
Bing AI chat did all it could I guess but after some time it was repeating the same solution over and over again about firewall rules and deleting root hints etc,...
The solution should be obvious without deleting anything. Doesn't make sense.
It must be common practice to separate internal and external name resolution for security reasons right?
The ip address of pfsense is 10.216.2.2
I'm curious if someone can give me a hint.

Thank you, I appreciate.