Messages

Thank you!

Yes, I was trying to use Unbound and there is a chance that might worked when I assumed it was ISP DNS. But when I tried Identity Association it did not work. It very well might have been user error like me not saving/reloading interface.

I appreciated the details your provided and that helped me getting DoT working as well. It seems the adage of "best way to find the correct answer is not to ask a question but to post the wrong answer" is true :)

Cheers!

[Update: please use IsaacFL's details below as they are correct and better.]

Update: please use IsaacFL's details below as they are correct and better.

******
Original post with some comments
After some trial and error I got it to work and wanted to share here as various pieces online had parts but not together. Some searches even suggested to disable IPv6.

I am using a 3rd party DNS provider and my issue was that the IPv6 DNS was coming from ISP and taking over. IPv4 was being respected but not IPv6.
System:Settings:General already had "Allow DNS server list to be overridden by DHCP/PPP on WAN" unchecked.

I am using Spectrum so here are the settings that worked for me.

WAN interface:
IPv6 Configuration Type: DHCPv6
Prefix delegation size: 56
Request prefix only: checked
Request DNS configuration: checked (unchecking this seems to stop the ISP from providing an IPv6 altogether)
Send prefix hint: checked

LAN interface
Track Interface (legacy) - obsolete option
Parent interface: WAN int name
Assign Prefix ID: using VLAN ID in hex
Reserved prefix range: 1 (beats my understanding)
Allow manual adjustment of DHCPv6 and Router Advertisements: checked

Services: Router Advertisements
Added an entry for LAN interface
Mode: Stateless
Recursive DNS Servers: IPV6 DNS servers - Use the better option from IsaacFL and add also the Unbound settings to make use of TLS.

Add additional advertisements for interfaces that need it. The above was done on OPNsense 26.7.3_8.