opnsense_dns.webp
$ cat /etc/resolv.conf
# This file was automatically generated by system_resolvconf_generate()
# If you want to append configuration here use /etc/resolv.conf.local
domain xxxxxxxxxxxxxxxx
nameserver 192.168.1.1
nameserver 1.1.1.1
nameserver 1.0.0.1
search xxxxxxxxxxxxxxx
$ drill google.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 41425
;; flags: qr rd ra ; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; google.com. IN A
;; ANSWER SECTION:
google.com. 114 IN A xxxxxxx
xxx
;; AUTHORITY SECTION:
;; ADDITIONAL SECTION:
;; Query time: 0 msec
;; SERVER: 192.168.1.1
# --
$ drill google.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 13948
;; flags: qr rd ra ; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; google.com. IN A
;; ANSWER SECTION:
google.com. 281 IN A xxx
xxxx
;; AUTHORITY SECTION:
;; ADDITIONAL SECTION:
;; Query time: 4 msec
;; SERVER: 1.1.1.1
I am currently using AdGuard Home as my main DNS server.
AdGuard Home responds immediately and works without issue.
However, whenever a DNS query is made, my device alternates between AdGuard Home (192.168.1.1) and Cloudflare DNS(1.1.1.1).
Is it possible to set it up so AdGuard Home is used as the sole primary DNS,
and Cloudflare DNS is only used as a fallback when AdGuard Home is delayed or unresponsive?
"drill" without any options explicitly randomizes the nameserver list. For the test you want, you must use "drill -z".
But that probably does not solve your actual issue. When OPNsense itself resolves a name using the servers from resolv.conf, they are normally tried in order, so you already have a kind of fallback there. The same is not guaranteed for DHCP clients to which you hand out a list of DNS servers.
The clients decide for themselves how to deal with a list of DNS servers, and that behavior differs between operating systems. Therefore, handing out AdGuard as DNS1 and Cloudflare as DNS2 does not reliably mean "use AdGuard unless it is unavailable".
If you want a real fallback for your clients, hand out only the address of a local resolver and implement the fallback there. For example, OPNsense's Dnsmasq has the option "Query DNS servers sequentially", which queries upstream DNS servers in the configured order.
Unbound with multiple forwarders would not provide strict primary/fallback ordering, as Unbound selects forwarders based on its own server-selection and RTT logic.