Messages

This seems to be resolved now.

[opnsense.org]

I have been having strange dns issues specifically with opnsense.org and nsX.sectigoweb.com delegated nameservers, and I wanted to share in case others were seeing similar results.  Since DNS is inherently transient due to TTL cache and delegation through root servers, I hope this issue resolves itself before long, but in case others have issues and end up here, here are my test results and symptoms.

Symptoms: 
1) Transient DNS lookup failures while checking for updates (pkg.opnsense.org)
2) DNS lookup failures attempting to browse to https://forum.opnsense.org in firefox
3) Nameservers hosted by sectigoweb seem to be misbehaving:
- delegation failure for ns1-ns4.sectigoweb.com https://intodns.com/opnsense.org
- Resolution failure:  https://dns.google/query?name=opnsense.org&rr_type=A&ecs=

Debugging:

• Cloudflare (1.1.1.1)
  
  Code Select Expand
  dig forum.opnsense.org @1.1.1.1

; <<>> DiG 9.20.26-1~deb13u1-Debian <<>> forum.opnsense.org @1.1.1.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 54821
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; EDE: 9 (DNSKEY Missing): (no SEP matching the DS found for opnsense.org.)
; EDE: 22 (No Reachable Authority): (at delegation opnsense.org.)
;; QUESTION SECTION:
;forum.opnsense.org.            IN      A

;; Query time: 16 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Wed Sep 02 22:26:37 UTC 2026
;; MSG SIZE  rcvd: 132
• Quad 9 (9.9.9.9)
  
  Code Select Expand
  dig forum.opnsense.org @9.9.9.9

; <<>> DiG 9.20.26-1~deb13u1-Debian <<>> forum.opnsense.org @9.9.9.9
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34292
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;forum.opnsense.org.            IN      A

;; ANSWER SECTION:
forum.opnsense.org.     699     IN      A       89.149.225.137

;; Query time: 0 msec
;; SERVER: 9.9.9.9#53(9.9.9.9) (UDP)
;; WHEN: Wed Sep 02 22:46:29 UTC 2026
;; MSG SIZE  rcvd: 63
• Google (8.8.8.8)
  
  Code Select Expand
  dig forum.opnsense.org @8.8.8.8

; <<>> DiG 9.20.26-1~deb13u1-Debian <<>> forum.opnsense.org @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 55647
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
; EDE: 22 (No Reachable Authority): (At delegation opnsense.org for forum.opnsense.org/a)
;; QUESTION SECTION:
;forum.opnsense.org.            IN      A

;; Query time: 20 msec
;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
;; WHEN: Wed Sep 02 22:47:12 UTC 2026
;; MSG SIZE  rcvd: 104

[not]

While OPNsense has the necessary dhcp6c code path to allow your FiOS WAN interface IPv6 configuration to have both a link local (fe80:: prefix) and a global IPv6 address, it will not configure it that way by default (as of OPNsense 26.1.4 in March 2026).

You will need to also configure a custom dhcp6c client configuration file in [Interfaces->WAN->DHCPv6 Client Configuration, then select Override Configuration Mode]  Example screenshot:
You cannot view this attachment.


Example /etc/dhcp6c.WAN_LAN.conf below:

• ssh into opnsense and create this text file from scratch, then apply to the web gui configuration
• adjust interface names to match your system (e.g. em0 to igc0 {do not use OPNsense alias names like WAN})
• You will need to specify every interface you want a prefix assigned to in the config.  Example below include WAN, LAN, and a tagged vlan for GUEST_VLAN devices
• You can customize the sla-id per interface as desired (each interface must be unique for /64 out of PD provided /56)

Code Select Expand

interface em0 {
        send ia-pd 0;   # request prefix delegation
        request domain-name-servers;
        request domain-name;
        script "/var/etc/dhcp6c_wan_script.sh"; # we'd like some nameservers please
};
id-assoc pd 0 {
#  Support prefix 0 on LAN interface (em1)
        prefix ::/56 infinity;
        prefix-interface em1 {
                sla-id 0;
                sla-len 8;
        };
# Support prefix 1 on GUEST_VLAN interface (vlan0.20 with a parent of em1)
        prefix-interface vlan0.20 {
                sla-id 1;
                sla-len 8;
        };
# Support prefix 16 on WAN interface (em0) - requires patch to dhcp6c prefixconf.c to enable on pfSense, but works out of the box on OPNsense
        prefix-interface em0 {
                sla-id 16;
                sla-len 8;
        };
};