PfSense with DNS forwarder to local DNS server: caching issue?

  • Hello,

    I might have a configuration problem with DNS forwarder.

    I already have a DNS server running on a Debian machine (, with bind9 9.7.3) which is responsible for resolving the internal local domain "mycompany.ext." to the LAN ( This domain is automatically populated by Dynamic DNS, the DHCP service being on the same Debian server.

    The pfSense ( is responsible for resolving the other Internet domains with the "DNS servers" list located at "System: General Setup":    WAN_A

    Computers located inside the LAN are told (via DHCP) to use (pfSense) as DNS server (and as their gateway) so that Internet resolution can be asked to by pfSense on behalf of local computers.
    To resolve "mycompany.ext." domain I tried to use "Services: DNS forwarder" by adding the following infos ne into the "Domain Overrides" list:

    Domain: mycompany.ext

    This Internet-resolution works fine but the local is buggy: at start it works fine, but after some time it won't find resolve local addresses:

    $ nslookup xxxxx.mycompany.ext
    server can't find xxxxx.mycompany.ext: NXDOMAIN

    Whereas if asking to the Debian DNS:

    $ nslookup xxxxx.mycompany.ext
    Name:   xxxxx.mycompany.ext

    For the pfSense to give an answer again, I have to disable and then enable the "DNS forwarder".

    Possible cause:
    I suspect the DNS forwarder service to have asked for "xxxxx.mycompany.ext" once while this machine was out of the office for a while (thus it's A record were deleted/obsolated from and it's returned that answer to pfSense) and to have cached this result. Thus, even when the A record has been recreated by DDNS on, pfSense keeps saying NXDOMAIN to any request.

  • Should I just configure a cron to periodically restart the DNS Forwarder?

Log in to reply