SERVFAIL when domain has no Authoritative Server or public DNS records

[NonGough]

ISP is the AT&T Fiber service.  The AT&T Fiber BGW320-500 modem offers WiFi and has four RJ45 ports which are assigned addresses in the 192.168.0.0/24 AT&T Fiber modem/firewall's local network.  This Fiber box effectively is a configureable firewall appliance with a built-in fiber modem doing the translations between the external fiber port and the internal RJ45 WAN port.   The AT&T WiFi option is unused and is secured with a password.  The OPNsense Protectli firewall appliance has a Grandstream WiFi device on a Virtual LAN connected to the OPNsense device via a TP-Link switch.  This OPNsense WiFi configuration works as expected.

Knowing that it would cause a double-NAT, I have chosen to not use the IP passthrough option through the AT&T Fiber modem/firewall for my OPNsense appliance, a Protectli device with adequate hardware resources.  The AT&T Fiber firewall has effective silent blocking of attempts of external actors to solicit responses to unsolicted protocols, ports, and packets.  As the OPNsense firewall appliance is a both an functional operational and a blood-sweat-and-tears learning tool, it helps a lot to have the OPNsense log not filled primarily with thousands of entries of unsolicted protocols and packets (roughly from 64 to 512 per hour).

My problem is that a website used by a Windows laptop (W10, updates current as of 2025.10 update) and a Windows desktop (W11, updates current as of 2026.07 update) references a domain name – dms.xxxxxx.com - generates a SERVFAIL because: 1) "all servers for this domain failed, at zone up.railway.app at [a valid IPv6 address] no server to query nameserver addresses not useable"; and per Services : Unbound DNS : Log File - 2) there is no public DNS records for the domain name – dms.xxxxxx.com – available per DNSchecker's "DNS Lookup" service (all worldwide authoritive servers including ICANN's agree on this).

Domains involved have been placed on the Services : Unbound DNS : Blocklists : Allowlist Domains to no effect.

When the Windows desktop bypasses OPNsense by directly by a dedicated use one of the AT&T Fiber's modem/firewall ports, the SERVFAIL does not occur!

OPNsense is at 26.1.11_10-amd64 and is current per the CLI Update from console and the OPNsense Web Gui's System : Firmware : Updates.  No IP's involved are on any IP DNSchecker blacklist.

CrowdSec and Unbound DNS OPNsense services do not affect the SERVFail in any combination of being Enabled or Disabled. The complete current list of plugin services added to the base OPNsense configuration is (with "*" is installed/configured/running, "**" is installed/not-configured; "***" is installed/configured/stopped):

System : Firmware : Plugins -  installed list (plugins not yet configured are labeled "misconfigured")
*     os-chrony – Chrony time synchronization (chrony daemon)
*** os-crowdsec – Lightweight and collaborative security engine
*** os-debug – Debugging Tools
*     os-demidecode – Display  hardware information on the dashboard
**   os-hw-probe (misconfigured) – Collect hardware diagnostics
**   os-iperf (misconfigured) – Connection speed tester
*     os-isc-dhcp – ISC DHCPv4/v6 server
**   os-maltrail (misconfigured) – Malicious traffic detection system
**   os-netdata (misconfigured) – Real-time performance monitoring
*     os-smart – SMART tools
*     os-telegraf (misconfigured) – Agent for collecting metrics and data
*     os-vnstat (misconfigured) – Network traffic monitor


Lobby : Dashboard : Services
*     chrony daemon
*     System Configuration Daemon
*     Cron
*** Crowdsec
*     ISC DHCPv4
*     ISC DHCPv6
*     Gateway monitor watcher
*     Gateway monitor (WAN_DHCP6)
*     Gateway monitor (WAN_DHCP4)
*     Insight Aggregator
*     Host discovery service
*** iperf Performance Test
*     Users and Groups
*   Packet Filter
*   Router Advertisements
*   System routing
*   NetFlow Distributor
*   Intrusion Detection
*   System tunables
*   Syslog-ng Daemon
*   Unbound DNS
*   vnStat Daemon
*   Web GUI 


Any thoughts on why OPNsense may be causing a SERVFAIL?

Is there an alternative to using UNBOUND DNS on OPNsense?

Could this be a ISC DHCPv4 and ISC DHCPv6 related issue?

Thoughts are appreciated, thank you.