Unbound Not Actually Blocking ANYTTHING, But Resolves No Problem

[ticker]

OPNsense 26.7.3_11 (amd64)
Everything was installed and configured using the GUI.
It has been running for over a year, I don't recall this being an issue previously, but I haven't looked at the machine beyond updating in a few months and I just noticed it this week.

I am having an issue where the Unbound DNS blocklist appears to download and load successfully, but domains are not actually being blocked for LAN clients.
It does seem to be resolving my domains without issue and properly. So I don't believe it is an issue with Unbound itself not being used, however an issue with Unblound actually blocking.
I could be wrong, but I believe it used to work without issue, I haven't messed with Opnsense in months. Just noticed this.

The Blocklist page reports approximately 1,327,249 entries loaded. I have several blocklists configured. I know that's a lot, and could cause false positives, don't really care.

As a test, ibrainer.net is known to be present in that list. I also manually added ibrainer.net under Blocklist Domains, but it continues to resolve normally.
This domain was just a random domain I chose in one of the blocklists to test with.

Testing:

From a Windows LAN client, I queried the firewall directly:
The client is definitely querying Unbound on OPNsense, but the real DNS records are returned.

Unbound Reporting shows the queries as Pass rather than Blocked. For example:

2026-09-11 03:08:58
[REDACTED CLIENT]
A
ibrainer.net.
Pass
Recursion
NOERROR
84ms
3600

2026-09-11 03:08:58
[REDACTED CLIENT]
AAAA
ibrainer.net.
Pass
Recursion
NOERROR
6ms
3600


After subsequent queries, they also appear as:

ibrainer.net.
Pass
Cache
NOERROR

I also tested metrics.icloud.com, which I manually added to Blocklist Domains, and it still resolves normally.

Other troubleshooting performed/settings statuses:

Confirmed Unbound DNS is enabled.
Confirmed all required LAN/VLAN interfaces are selected under Unbound.
Source Net(s) is empty/default.
Destination Address is empty/default.
Return NXDOMAIN is unchecked.
Cache TTL is set to 72000.
Unbound Access Lists are empty.
Restarted Unbound with Flush Cache on Restart enabled.
Flushed the Windows DNS cache with ipconfig /flushdns.
Retested using the firewall address directly (192.168.1.1).
Confirmed the blocklist downloads and reports approximately 1.33 million entries under Reporting > Unbound DNS.
Added ibrainer.net manually to Blocklist Domains as a direct test.
The built-in blocklist tester returns:
{"status":"error"}

I also tried fresh resetting the reporting. Shows 0 under blocked, while resolved is slowly going up.

I also tried manually clicking block on the ibrainer.net domain in the Reporting > Unbound DNS and it does toggle the icon so I can "allow it" after, so it seems to be "blocking it"... however it doens't actually appear to be blocking it.


The main issue appears to be that the blocklists are being downloaded/parsed, but the resulting DNSBL rules are not being applied to client queries. Fresh queries are still reported as Pass / Recursion / NOERROR instead of being blocked. Domains are resolving normally, my DNS is fine. I have my whole network set to use Unbound for DNS resolution. It just seems like absolutely NOTHING is being blocked for some reason.