Give pfSense forwarding DNS a viable route through each WAN

A second Internet circuit is insufficient if all configured resolvers depend on the failed first circuit.

Source facts

Netgate explains that DNS forwarding uses the firewall routing table. Configured DNS servers can be associated with gateways so queries use a specific WAN, and the source calls for unique server entries rather than repeating one address for several gateways. Default recursive-resolver operation instead requires default-gateway failover for Multi-WAN resilience.

Source: Netgate — Interface and DNS Configuration.

Applicability

This concerns pfSense DNS Resolver modes and DNS Forwarder configuration.

DSE recommendation

DSE recommends recording whether the installation performs recursive resolution or forwards to selected servers before changing Multi-WAN DNS. For forwarding, map each resolver to an appropriate circuit and confirm any provider access restriction. Review monitor addresses for conflicts with resolver routes. Test the firewall’s own name resolution and the client DNS service independently so a reachable public IP is not mistaken for a functioning Internet experience. Retain a resolver-to-gateway table with the circuit inventory. Have the DNS owner choose an uncached test name for the rehearsal and describe the expected upstream path for each mode. Treat a failed firewall lookup and a failed client lookup as separate findings.

Verification

During a controlled circuit-loss test, query a known external name through the intended local DNS service and inspect the outbound route to the resolver. Repeat for the other WAN and after restoration. Record failures by resolver and transport path rather than replacing several unrelated DNS settings at once.

Official reference

Netgate — Interface and DNS Configuration. Reviewed October 20, 2026.