Hello everyone, what I’m showing you is a custom on dnsresolver of pfsense.
Server:
Local-data: "smtp.internal2.lan. IN A 192.168.3.83"
Local-data: "internal2.lan. IN MX 10 smtp.internal2.lan."
Local-data-ptr: "192.168.3.83 smtp.internal2.lan."
Local-data: "_ldap._tcp.internal2.lan. IN SRV 0 100 389 ad.internal2.lan."
Local-data: "_kerberos._udp.internal2.lan. IN SRV 0 100 88 ad.internal2.lan."
Local-data: "_ldap._tcp.gc._msdcs.internal2.lan. IN SRV 0 100 3268 ad.internal2.lan."
Local-data: "_kerberos._tcp.internal2.lan. IN SRV 0 100 88 ad.internal2.lan."
Log-queries: no
Server:
Local-data: "ns8.internal.lan. IN A 192.168.3.76"
Local-data: "internal.lan. IN MX 10 ns8.internal.lan."
Local-data-ptr: "192.168.3.76 ns8.internal.lan."
Local-data: "_kerberos._tcp.internal.lan. IN SRV 0 100 88 dc1.ad.internal.lan."
Local-data: "_kerberos._udp.internal.lan. IN SRV 0 100 88 dc1.ad.internal.lan."
Local-data: "_ldap._tcp.gc._msdcs.internal.lan. IN SRV 0 100 3268 dc1.ad.internal.lan."
Local-data: "_ldap._tcp.internal.lan. IN SRV 0 100 389 dc1.ad.internal.lan."
Log-queries: no
Local-data: "ns8.internal.lan. IN A 192.168.3.76"
Local-data-ptr: "192.168.3.76 ns8.internal.lan."
Local-data: "dc1.ad.internal.lan. IN A 192.168.3.76"
Local-data-ptr: "192.168.3.76 dc1.ad.internal.lan."
The AD servers are ns8 and neth7 . All hosts have as primary dos pihole which in turn has only an upstream des which is the pfsense, which in addition to other custom options that I have listed, forwards the Queries to the competent domains.
ad.internal2.lan 192.168.3.78 Active directory ad.internal2.lan
7.168.192.in-addr.arpa 192.168.3.83 Reverse lan to neh7
internal3.lan 192.168.3.84 Domain 2019
ad.internal.lan 192.168.3.76 internal AD
internal.lan 192.168.3.76 Dns internal.lan
3.168.192.in-addr.arpa 192.168.3.83 Zone inverse rete 192.168.3.0/24
internal2.lan 192.168.3.83 Zone internal2.lan
Hi Mark, pihole as written before is the primary dns, and use as upstream pfsense. I have been trying to insert the conditional forward for the zones for a long time and it works regularly but with the exception that the mx records are not resolved by nethserver. Example if I enable for the internal.lan and internral2.lan zones the respective competence domains , the servfail error does not occur . But from any client if I query host -t mx internal2.lan the result is null , so no mx for the internal2.lan area . Reason why I created the custom on dnsresolv of pfense (unbounbd), the records of my interest. However, this problem that in the end is not really blocking, it alone with neth7 and not on ns8. I don’t understand why if I request the internal2.lan zone from pihole and therefore not directing it to the pfsense upstream, the mx record on neth7 is missing. The script that I showed you indeed the results it shows are the pihole queries that it sends to pfsense that responds correctly for the resolutions declared in the custom file. As you wrote, you want to try to perform tests, but my goal is to understand why neth7 or pfsense respond with servfail! Thank you as always for your availability.
Which DNS server are the NS7 and the NS8 are using?
If you use a DNS conditional forward for internal2.lan to NS7 and the NS7 upstream DNS is an external one and not the pfsense, then you get no result for “internal2.lan” because the external DNS doesn’t provide the MX record for internal2.lan and NS7/NS8 don’t provide MX records by default.
DNS Check — 2025-09-05 19:54:58
[A] smtp.internal2.lan… 192.168.3.83
Fine verifica
