DNS - Best Pracices

[Giz]

Noob here! (formerly a sonicwall guy)

Okay I have a couple opns (25.7.5) running now but am a little unsure of best practices with opnsense regarding nat'ed services
I currently have dns (bind9) running internally and nat'ed ns1 and it appears to be functioning. But ns1 is config'd to use google's ns servers.
I am looking for the best way (suggestive) to config opn and secure ns1 so it's dns is protected properly.

TIA
Giz..

[BrandyWine]

Use malware protecting fwd'ers, like 9.9.9.11, or the like.
Use DNSSEC.
Config your fw rule to allow only your bind IP to goto your selected fwd'er.

From there it should be pretty good.

[Giz]

Use malware protecting fwd'ers, like 9.9.9.11, or the like.
Use DNSSEC.
Config your fw rule to allow only your bind IP to goto your selected fwd'er.

From there it should be pretty good.

1) Okay so quad9 gives me: 9.9.9.9, 149.112.112.112  can I set that somewhere in opnsense and then configure my ns server to fwd to lan side of opnsense?
2) For this particular domain I have dnssec turned on at godaddy

Tks for the starting places to read up on.
Giz..

[BrandyWine]

Use the malware blocking set:
Secured w/ECS: Malware blocking, DNSSEC Validation, ECS enabled
IPv4
9.9.9.11
149.112.112.11
(https://quad9.net/service/service-addresses-and-features/)

OPNsense has the "unbound" dns service you can setup, and you can fwd to it. But why, just allow your bind to do what it needs to do.
Just make your bind DNS the primary DNS for everything. bind will be way more robust when it comes to features.

[DEC670airp414user]

Use malware protecting fwd'ers, like 9.9.9.11, or the like.
Use DNSSEC.
Config your fw rule to allow only your bind IP to goto your selected fwd'er.

From there it should be pretty good.

if using dns servers that use dnssec.   i typically leave enable dnssec turned off within opnsense
quad9
nextdns
and controld for my usage

[Giz]

if using dns servers that use dnssec.   i typically leave enable dnssec turned off within opnsense
quad9
nextdns
and controld for my usage

Tks for the replies (Dec & Brandy)

Yeah, am thinking to leave opn alone and just use the fwd'rs at ns level
Giz..