Check resolved addresses before using a pfSense hostname alias for a public service

A DNS-backed firewall alias is a periodically refreshed address set, not a hostname-aware web filter.

Source facts

pfSense host and network aliases can resolve fully qualified hostnames through A and AAAA queries. Netgate states that aliases do not perform wildcard matching, SRV lookups, or other record comparisons. Multiple returned addresses are added from the query result, and hostname entries are refreshed periodically. This has an important limitation for large CDN-backed websites: the firewall’s DNS response can differ from a client’s localized or rotating answer. Netgate therefore warns that this feature is not useful for reliably controlling access to such public hostnames.

Source: Netgate — Alias features and limitations.

Applicability

This applies to DNS entries inside pfSense host or network aliases. It is separate from application-layer URL filtering, DNS policy enforcement, and the firewall’s own ability to resolve a name.

DSE recommendation

DSE recommends documenting whether the requirement is to allow a stable address set or control access to a named web service. For a small stable service, inspect the alias’s actual resolved contents and refresh behavior. For a distributed public service, use an appropriate supported control after reviewing its semantics rather than widening the alias repeatedly. Record the DNS resolver used by the firewall and the test clients. Avoid wildcard-looking entries that imply matching behavior the alias cannot provide.

Verification

For an approved test hostname, compare the firewall’s resolved alias entries with the client’s DNS answers over time. Verify IPv4 and IPv6 where applicable. If results diverge, record that limitation and revisit the control design instead of treating an intermittently successful connection as complete coverage.

Official reference

Netgate — Alias features and limitations. Reviewed October 15, 2026.