Hosts alias does not use all A records

[GurliGebis]

can try to enable "Do not use the local DNS service as a nameserver for this system" on "System: Settings: General"
https://docs.opnsense.org/manual/settingsmenu.html#general

Yep, that did the trick.
Had to do some other tricks to get the app to work (conditional forwarding that domain directly outside from my internal dns server).

It is a mess, but it works

[Fright]

It's a complete mess, but I'm glad it works 

[GurliGebis]

Me too - do you think it would have worked lowering the alias interval to something lower than the TTL on the records?

[Fright]

I would try to leave it as it is (I think that most likely this is just balancing and everything will work with default 300sec). if there are periodic connection losses, then you can try to reduce the update interval
AWS TTL is too short imho - in any case i would not set such a short interval (~60sec) for Alias hostname resolution.

[GurliGebis]

Okay, I'll leave it as is - it seems to be working now, which is the most important part.

Limiting IoT devices is an interresting challenge.

[GurliGebis]

I optimized it a bit, instead of having to use a conditional forwarder for my internal dns, i included a custom config for unbound that overrides the host only for my IOT VLAN