{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/pfsense-hostname-alias-dns-cdn-limitations/", "item": { "id": "https://update.dsesecurity.com/updates/pfsense-hostname-alias-dns-cdn-limitations/", "slug": "pfsense-hostname-alias-dns-cdn-limitations", "url": "https://update.dsesecurity.com/updates/pfsense-hostname-alias-dns-cdn-limitations/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/pfsense-hostname-alias-dns-cdn-limitations.md", "json": "https://update.dsesecurity.com/api/v1/posts/pfsense-hostname-alias-dns-cdn-limitations/" }, "title": "Check resolved addresses before using a pfSense hostname alias for a public service", "summary": "A DNS-backed firewall alias is a periodically refreshed address set, not a hostname-aware web filter.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-15T13:33:32+00:00", "modified_at": "2026-10-15T13:36:17+00:00", "reviewed_on": "2026-10-15", "reading_minutes": 2, "word_count": 279, "potentially_affected": "This applies to DNS entries inside pfSense host or network aliases. It is separate from application-layer URL filtering, DNS policy enforcement, and the firewall’s own ability to resolve a name.", "dse_recommendation": "DSE recommends documenting whether the requirement is to allow a stable address set or control access to a named web service.", "primary_source": { "name": "Netgate — Alias features and limitations", "url": "https://docs.netgate.com/pfsense/en/latest/firewall/aliases-features.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

A DNS-backed firewall alias is a periodically refreshed address set, not a hostname-aware web filter.

\n

Source facts

\n

pfSense host and network aliases can resolve fully qualified hostnames through A and AAAA queries. Netgate states that aliases do not perform wildcard matching, SRV lookups, or other record comparisons. Multiple returned addresses are added from the query result, and hostname entries are refreshed periodically. This has an important limitation for large CDN-backed websites: the firewall’s DNS response can differ from a client’s localized or rotating answer. Netgate therefore warns that this feature is not useful for reliably controlling access to such public hostnames.

\n

Source: Netgate — Alias features and limitations.

\n

Applicability

\n

This applies to DNS entries inside pfSense host or network aliases. It is separate from application-layer URL filtering, DNS policy enforcement, and the firewall’s own ability to resolve a name.

\n

DSE recommendation

\n

DSE recommends documenting whether the requirement is to allow a stable address set or control access to a named web service. For a small stable service, inspect the alias’s actual resolved contents and refresh behavior. For a distributed public service, use an appropriate supported control after reviewing its semantics rather than widening the alias repeatedly. Record the DNS resolver used by the firewall and the test clients. Avoid wildcard-looking entries that imply matching behavior the alias cannot provide.

\n

Verification

\n

For an approved test hostname, compare the firewall’s resolved alias entries with the client’s DNS answers over time. Verify IPv4 and IPv6 where applicable. If results diverge, record that limitation and revisit the control design instead of treating an intermittently successful connection as complete coverage.

\n

Official reference

\n

Netgate — Alias features and limitations. Reviewed October 15, 2026.

", "content_text": "A DNS-backed firewall alias is a periodically refreshed address set, not a hostname-aware web filter.\nSource facts\npfSense host and network aliases can resolve fully qualified hostnames through A and AAAA queries. Netgate states that aliases do not perform wildcard matching, SRV lookups, or other record comparisons. Multiple returned addresses are added from the query result, and hostname entries are refreshed periodically. This has an important limitation for large CDN-backed websites: the firewall’s DNS response can differ from a client’s localized or rotating answer. Netgate therefore warns that this feature is not useful for reliably controlling access to such public hostnames.\nSource: Netgate — Alias features and limitations.\nApplicability\nThis applies to DNS entries inside pfSense host or network aliases. It is separate from application-layer URL filtering, DNS policy enforcement, and the firewall’s own ability to resolve a name.\nDSE recommendation\nDSE recommends documenting whether the requirement is to allow a stable address set or control access to a named web service. For a small stable service, inspect the alias’s actual resolved contents and refresh behavior. For a distributed public service, use an appropriate supported control after reviewing its semantics rather than widening the alias repeatedly. Record the DNS resolver used by the firewall and the test clients. Avoid wildcard-looking entries that imply matching behavior the alias cannot provide.\nVerification\nFor an approved test hostname, compare the firewall’s resolved alias entries with the client’s DNS answers over time. Verify IPv4 and IPv6 where applicable. If results diverge, record that limitation and revisit the control design instead of treating an intermittently successful connection as complete coverage.\nOfficial reference\nNetgate — Alias features and limitations. Reviewed October 15, 2026.", "content_markdown": "A DNS-backed firewall alias is a periodically refreshed address set, not a hostname-aware web filter.\n\n## Source facts\n\npfSense host and network aliases can resolve fully qualified hostnames through A and AAAA queries. Netgate states that aliases do not perform wildcard matching, SRV lookups, or other record comparisons. Multiple returned addresses are added from the query result, and hostname entries are refreshed periodically. This has an important limitation for large CDN-backed websites: the firewall’s DNS response can differ from a client’s localized or rotating answer. Netgate therefore warns that this feature is not useful for reliably controlling access to such public hostnames.\n\nSource: [Netgate — Alias features and limitations](https://docs.netgate.com/pfsense/en/latest/firewall/aliases-features.html).\n\n## Applicability\n\nThis applies to DNS entries inside pfSense host or network aliases. It is separate from application-layer URL filtering, DNS policy enforcement, and the firewall’s own ability to resolve a name.\n\n## DSE recommendation\n\nDSE recommends documenting whether the requirement is to allow a stable address set or control access to a named web service. For a small stable service, inspect the alias’s actual resolved contents and refresh behavior. For a distributed public service, use an appropriate supported control after reviewing its semantics rather than widening the alias repeatedly. Record the DNS resolver used by the firewall and the test clients. Avoid wildcard-looking entries that imply matching behavior the alias cannot provide.\n\n## Verification\n\nFor an approved test hostname, compare the firewall’s resolved alias entries with the client’s DNS answers over time. Verify IPv4 and IPv6 where applicable. If results diverge, record that limitation and revisit the control design instead of treating an intermittently successful connection as complete coverage.\n\n## Official reference\n\n[Netgate — Alias features and limitations](https://docs.netgate.com/pfsense/en/latest/firewall/aliases-features.html). Reviewed October 15, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/pfsense-hostname-alias-dns-cdn-limitations/", "url": "https://update.dsesecurity.com/updates/pfsense-hostname-alias-dns-cdn-limitations/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-15" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/pfsense-hostname-alias-dns-cdn-limitations/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check resolved addresses before using a pfSense hostname alias for a public service", "item": "https://update.dsesecurity.com/updates/pfsense-hostname-alias-dns-cdn-limitations/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/pfsense-hostname-alias-dns-cdn-limitations/#article", "identifier": "https://update.dsesecurity.com/updates/pfsense-hostname-alias-dns-cdn-limitations/", "url": "https://update.dsesecurity.com/updates/pfsense-hostname-alias-dns-cdn-limitations/", "headline": "Check resolved addresses before using a pfSense hostname alias for a public service", "description": "A DNS-backed firewall alias is a periodically refreshed address set, not a hostname-aware web filter.", "abstract": "A DNS-backed firewall alias is a periodically refreshed address set, not a hostname-aware web filter.", "articleBody": "A DNS-backed firewall alias is a periodically refreshed address set, not a hostname-aware web filter.\nSource facts\npfSense host and network aliases can resolve fully qualified hostnames through A and AAAA queries. Netgate states that aliases do not perform wildcard matching, SRV lookups, or other record comparisons. Multiple returned addresses are added from the query result, and hostname entries are refreshed periodically. This has an important limitation for large CDN-backed websites: the firewall’s DNS response can differ from a client’s localized or rotating answer. Netgate therefore warns that this feature is not useful for reliably controlling access to such public hostnames.\nSource: Netgate — Alias features and limitations.\nApplicability\nThis applies to DNS entries inside pfSense host or network aliases. It is separate from application-layer URL filtering, DNS policy enforcement, and the firewall’s own ability to resolve a name.\nDSE recommendation\nDSE recommends documenting whether the requirement is to allow a stable address set or control access to a named web service. For a small stable service, inspect the alias’s actual resolved contents and refresh behavior. For a distributed public service, use an appropriate supported control after reviewing its semantics rather than widening the alias repeatedly. Record the DNS resolver used by the firewall and the test clients. Avoid wildcard-looking entries that imply matching behavior the alias cannot provide.\nVerification\nFor an approved test hostname, compare the firewall’s resolved alias entries with the client’s DNS answers over time. Verify IPv4 and IPv6 where applicable. If results diverge, record that limitation and revisit the control design instead of treating an intermittently successful connection as complete coverage.\nOfficial reference\nNetgate — Alias features and limitations. Reviewed October 15, 2026.", "datePublished": "2026-10-15T13:33:32+00:00", "dateModified": "2026-10-15T13:36:17+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/pfsense-hostname-alias-dns-cdn-limitations/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/pfsense-hostname-alias-dns-cdn-limitations/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check resolved addresses before using a pfSense hostname alias for a public service" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 279, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — Alias features and limitations", "url": "https://docs.netgate.com/pfsense/en/latest/firewall/aliases-features.html" } } ] } }