# Give pfSense forwarding DNS a viable route through each WAN

> A second Internet circuit is insufficient if all configured resolvers depend on the failed first circuit.

- Canonical URL: https://update.dsesecurity.com/updates/give-pfsense-forwarding-dns-a-viable-route-through-each-wan/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:05+00:00
- Modified: 2026-10-20T18:34:34+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

A second Internet circuit is insufficient if all configured resolvers depend on the failed first circuit.

## Potentially affected

This concerns pfSense DNS Resolver modes and DNS Forwarder configuration.

## DSE recommendation

DSE recommends recording whether the installation performs recursive resolution or forwards to selected servers before changing Multi-WAN DNS.

## Article

A second Internet circuit is insufficient if all configured resolvers depend on the failed first circuit.

## Source facts

Netgate explains that DNS forwarding uses the firewall routing table. Configured DNS servers can be associated with gateways so queries use a specific WAN, and the source calls for unique server entries rather than repeating one address for several gateways. Default recursive-resolver operation instead requires default-gateway failover for Multi-WAN resilience.

Source: [Netgate — Interface and DNS Configuration](https://docs.netgate.com/pfsense/en/latest/multiwan/interfaces-and-dns.html).

## Applicability

This concerns pfSense DNS Resolver modes and DNS Forwarder configuration.

## DSE recommendation

DSE recommends recording whether the installation performs recursive resolution or forwards to selected servers before changing Multi-WAN DNS. For forwarding, map each resolver to an appropriate circuit and confirm any provider access restriction. Review monitor addresses for conflicts with resolver routes. Test the firewall’s own name resolution and the client DNS service independently so a reachable public IP is not mistaken for a functioning Internet experience. Retain a resolver-to-gateway table with the circuit inventory. Have the DNS owner choose an uncached test name for the rehearsal and describe the expected upstream path for each mode. Treat a failed firewall lookup and a failed client lookup as separate findings.

## Verification

During a controlled circuit-loss test, query a known external name through the intended local DNS service and inspect the outbound route to the resolver. Repeat for the other WAN and after restoration. Record failures by resolver and transport path rather than replacing several unrelated DNS settings at once.

## Official reference

[Netgate — Interface and DNS Configuration](https://docs.netgate.com/pfsense/en/latest/multiwan/interfaces-and-dns.html). Reviewed October 20, 2026.

## Primary reference

- Name: Netgate — Interface and DNS Configuration
- Authority: docs.netgate.com
- URL: https://docs.netgate.com/pfsense/en/latest/multiwan/interfaces-and-dns.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Give pfSense forwarding DNS a viable route through each WAN,” DSE Security, https://update.dsesecurity.com/updates/give-pfsense-forwarding-dns-a-viable-route-through-each-wan/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.