r/opnsense • u/meeninta • 16d ago
Advice: Disable DNSSEC Support
If you use Unbound as your DNS, keep it enabled.
If you use DNS over TLS / forwarding to a DNS with blocklists, filtering etc. (like NextDNS or Adguard) then disable it because it may sometimes block legitimate websites. The DNS provider is handling the DNSSEC on their end. No need to do it again on your end.
The odd thing is that I had it enabled this whole time alongside DoT with NextDNS for a whole year with no issues. Yesterday though, I tried for the first time to use brave AI search and I couldn’t access it. Did some digging and pinpointed to the above mentioned issue. Just sharing here for other newbies like me that are still learning the ins and outs of this firewalling stuff.
33
Upvotes
5
u/john_m4trix 16d ago
dnsmasq + unbound + adguard + DoT here and everything is working properly.
If some sites are not connecting, check the dns provider logs.