Use a domain-specific pfSense rebinding exception for legitimate private DNS answers

A necessary private-address answer should not require disabling rebinding protection everywhere.

Source facts

Netgate documents rebinding protection that strips private and local addresses from upstream DNS responses. Legitimate internal names or DNS-based blocklists can require a domain exception, with different configuration syntax for the Resolver and Forwarder. The firewall GUI also has its own hostname protection, which is a separate layer from filtering DNS answers.

Source: Netgate — DNS Rebinding Protections.

Applicability

This concerns pfSense DNS rebinding controls.

DSE recommendation

DSE recommends identifying whether the failure occurs in the DNS answer or at the GUI hostname check before changing controls. Verify the domain owner, expected private destination, and active DNS service. Prefer the narrow domain exception described for that service over allowing every private or loopback response. Keep the approved exception’s purpose and owner visible in the configuration record, and revisit it when the internal naming design changes. For an exception request, require the exact domain, expected private answer, DNS service in use, and business owner. Compare a permitted internal response with an unrelated private-address response that should still be rejected. Keep GUI hostname changes outside that DNS-answer exception unless independently justified.

Verification

Query the intended name through the actual client resolver path and inspect the answer before and after the approved exception. Test an unrelated controlled private-address response to confirm protection remains effective outside the allowed domain. If the GUI rejects the hostname, review its allowed-name configuration separately instead of assuming DNS filtering is still the cause.

Official reference

Netgate — DNS Rebinding Protections. Reviewed October 20, 2026.