How to Change DNS on pfSense (Firewall-Wide + Encrypted DoT)

Why change DNS on pfSense

pfSense is a full firewall/router OS, so “changing DNS” has two distinct layers, and it helps to be clear about which one you’re touching:

• What the firewall itself uses. The DNS servers under System → General Setup are the resolvers pfSense uses for its own lookups (package updates, gateway monitoring, and — if you turn on forwarding — where the DNS Resolver sends client queries).
• What your LAN clients use. Out of the box, pfSense runs the DNS Resolver (Unbound) in resolver mode: it answers your devices by walking the DNS tree from the root servers itself, so it does not use the General Setup list at all. To make your LAN actually use Cloudflare, Google, Quad9, or whatever won your speed test, you switch Unbound into Forwarding Mode so it forwards to the General Setup servers.

Setting a fast upstream resolver shortens the lookup delay before a page starts loading for every device behind the firewall — it does not increase your bandwidth or download speed; it only trims the round-trip spent resolving each hostname. If you’d rather keep full recursive resolution (which many pfSense users prefer for privacy and independence from any single provider), you can leave Unbound in resolver mode and skip the forwarding step entirely.

Before you start, run the DNS speed test from a device on this LAN and pick the resolver that responds fastest from your connection, then use its addresses in the steps above. The public DNS servers list is handy if you also care about filtering or privacy, not just raw speed.

Resolver mode vs. Forwarding mode

This is the most common source of confusion, so it’s worth stating plainly:

• Leave forwarding off and Unbound ignores your General Setup DNS servers for client queries and resolves everything itself from the root. The General Setup list still applies to the firewall’s own traffic.
• Turn forwarding on (Services → DNS Resolver → Enable Forwarding Mode) and Unbound forwards client queries to the servers you listed in General Setup. This is what you want if the whole point is to route your LAN through a specific fast/filtering resolver.

Whichever you choose, DHCP hands your LAN clients the pfSense LAN IP as their DNS server, and pfSense answers via Unbound — so there is normally no need to touch each device.

Encrypted DNS (DoH/DoT) on pfSense

pfSense supports DNS-over-TLS (DoT) natively through Unbound; it does not provide a built-in DNS-over-HTTPS (DoH) upstream option in the standard UI. To encrypt the firewall’s outbound lookups with DoT:

1. Go to Services → DNS Resolver (Unbound) and make sure the resolver is enabled (it is by default).
2. Check Enable Forwarding Mode.
3. Check Use SSL/TLS for outgoing DNS Queries (Forwarding Mode). This tells Unbound to reach your General Setup DNS servers over TLS on port 853 instead of plain UDP/53.
4. Confirm your DoT-capable resolver IPs are listed under System → General Setup (for example Cloudflare’s 1.1.1.1 and 1.0.0.1), then Save and Apply Changes.

The GUI checkbox gets you encrypted transport, but it connects by IP and does not, on its own, verify the resolver’s TLS certificate name. For strict validation you add an explicit forward block in Services → DNS Resolver → Custom Options using Unbound’s forward-addr: IP@853#hostname syntax — for Cloudflare that hostname is cloudflare-dns.com. Because that block is easy to get subtly wrong, use our encrypted DNS setup generator to produce the exact Unbound forward-zone snippet for your chosen resolver, then paste it into Custom Options.

Remember this only encrypts DNS leaving the firewall. Your LAN clients still talk to pfSense in plaintext on your local network, which is normal and expected for a router-level setup.

Verify it worked

From a shell on pfSense (Diagnostics → Command Prompt, or SSH), or from any LAN device, confirm resolution is working and going where you expect. On a LAN client:

nslookup example.com

The Server it reports should be your pfSense LAN IP (that’s Unbound answering). To confirm the upstream path from pfSense itself, use Diagnostics → DNS Lookup in the web UI — it shows which configured DNS servers resolved the name and how long each took.

If you enabled DoT, you can sanity-check that port 853 traffic is actually flowing by watching Diagnostics → States or a packet capture filtered on port 853 while you trigger a fresh lookup. Then reload this site and run the DNS speed test again from a LAN device — your chosen resolver should now be the one doing the work.

Troubleshooting

• LAN devices still resolve, but nothing seems to route through my new resolver. You almost certainly left Unbound in resolver mode. Enable Forwarding Mode (Services → DNS Resolver), Save, and Apply.
• No resolution at all after enabling SSL/TLS. Your listed resolver may not support DoT on port 853, or a firewall rule/upstream is blocking 853. Confirm the resolver’s DoT support on the public DNS servers list and that outbound 853 isn’t blocked.
• Resolver IPs keep getting replaced. Re-check that “Allow DNS server list to be overridden by DHCP/PPP on WAN” is unchecked — a DHCP/PPPoE WAN will otherwise inject the ISP’s DNS.
• DNS Resolver won’t start / logs show a syntax error. A malformed Custom Options block is the usual cause. Remove your custom forward-zone snippet, confirm the resolver starts, then re-add a clean block from the generator.
• Package updates or gateway monitoring fail but clients are fine. That points at the firewall’s own DNS (General Setup), not Unbound — verify the General Setup servers are reachable from the WAN.

Revert to your old settings

To undo the upstream change, return to System → General Setup, clear your custom DNS servers (or set them back to your ISP’s), and re-check “Allow DNS server list to be overridden by DHCP/PPP on WAN” if you want the ISP’s DNS back automatically, then Save.

To undo encryption and forwarding, go to Services → DNS Resolver, uncheck Use SSL/TLS for outgoing DNS Queries and Enable Forwarding Mode, remove any custom forward block you pasted into Custom Options, then Save and Apply Changes. Unbound returns to resolving recursively from the root servers — the pfSense default.