OPNsense 25.1.7_4 - The setup is according to the official documentation.
Everything works fine until Unbound to dnsmasq returns 5(REFUSED), restarting dnsmasq solves the issue
That is probably because not all of your defined local domains are actually handled as local. See this for details (https://github.com/opnsense/core/issues/8726).
There is a patch underway, which will address this:
https://github.com/opnsense/core/commit/4381fe4903ecbeff19ebd1e04b789628e51124ef
You can use it now via "opnsense-patch 4381fe4903ecbeff19ebd1e04b789628e51124ef; configctl webgui restart" and then edit your static reservations to set the "local" flag for all local domains.
Thanks, I tried and got this:
sudo opnsense-patch 4381fe4903ecbeff19ebd1e04b789628e51124ef; configctl webgui restart
Fetched 4381fe4903ecbeff19ebd1e04b789628e51124ef via https://github.com/opnsense/core
1 out of 1 hunks failed while patching opnsense/service/templates/OPNsense/Dnsmasq/dnsmasq.conf
OK
Then this has been applied with other preceeding patches. Wait for the next update.