DNS over TLS on pfSense: Encrypt Unbound's Upstream Queries

Tue, 11 Aug 2026 16:57:45 -0400

Every unencrypted DNS query leaves the network in plaintext — your ISP, and anyone else on the path, sees every domain being looked up, even if the site itself is HTTPS. DNS over TLS (DoT) encrypts that query between pfSense’s Unbound resolver and the upstream DNS provider, closing that specific gap. This is the resolver both WireGuard guides already point client DNS at — this post covers securing it.

What this does and doesn’t protect

	Covered by DoT	Not covered
ISP seeing which domains you look up	Yes	—
On-path DNS spoofing/tampering of the upstream query	Yes	—
Traffic content once a connection is made	—	No — DoT is DNS only, not a VPN
Which IPs you connect to (visible via the connection itself)	—	No — SNI/IP are still visible unless also using something like encrypted SNI or a VPN
Local, LAN-side query visibility (anyone on your LAN)	—	No — DoT only covers the pfSense-to-upstream leg

DoT vs. DoH — why this guide uses DoT

Unbound (pfSense’s resolver) has native, GUI-exposed support for DNS over TLS. It does not natively speak DNS over HTTPS (DoH) as a client — getting DoH would mean chaining Unbound to an external DoH-capable forwarder (e.g., cloudflared) running as a separate service, adding a moving part for no real security difference at the resolver level. DoT is the natural fit for pfSense’s built-in tooling; use it unless something specific requires DoH.

DNS on Dad's a Nerd!

DNS over TLS on pfSense: Encrypt Unbound's Upstream Queries

What this does and doesn’t protect

DoT vs. DoH — why this guide uses DoT