Korthveil can answer DNS for your networks with one of two programs. Only one runs at a time, because both answer on port 53:

	DNS resolver (recommended)	DNS forwarder
Program	Unbound	dnsmasq
Where answers come from	Asks the internet's name servers itself, or forwards to providers over TLS (encrypted, port 853)	Forwards every question to your upstream DNS servers in plain DNS (port 53, not encrypted)
DNSSEC, ad and tracker blocking, filtering	Yes	No
Local names, internal domains, redirecting all DNS to the firewall	Yes	Yes
Names of DHCP clients (e.g. `laptop.lan`)	Through local names	Automatically, from the DHCP server's leases
Like pfSense's	DNS Resolver	DNS Forwarder

The forwarder is off by default. Use it when you want the simple pfSense-style forwarder, for example to pass everything to your provider's or your company's DNS servers and to find your devices by name. For encrypted DNS to the internet (the setup in the guide "DNS filtering and ad blocking"), keep the resolver.

At a glance:

Step	Where	What
1	Network › DNS forwarder › DNS service	Choose DNS forwarder: the resolver is switched off, its settings stay
2	Network › DNS forwarder › Settings	The networks to answer, the upstream servers, the local domain
3	Network › DNS forwarder	Optional: host overrides, domain overrides, redirect all DNS
4	Commit	Review the pending changes and commit

Step 1: Choose the DNS forwarder

Open Network › DNS forwarder. Under DNS service, choose DNS forwarder. The same choice is on the DNS resolver page.

DNS service: the resolver, the forwarder (chosen) or neither; only one can run

The DNS resolver is switched off with the next commit. Its settings (blocklists, local names, interception) stay, so you can go back at any time.
If you had Redirect clients' DNS on in the resolver, the forwarder starts with its redirect on too, so devices keep using the firewall.
A configuration with both switched on cannot be committed: the commit says "the DNS forwarder and the DNS resolver cannot run at the same time".

Step 2: Settings

Networks the forwarder answers: tick your internal zones (for example LAN and WLAN). Never tick the internet side: the forwarder would answer anyone on the internet.
Upstream DNS servers: one per line, IPv4 or IPv6, with #port for another port (for example 10.0.0.10#5353). Empty: the firewall's own DNS servers (System › DNS). The forwarder never uses itself as an upstream.
Ask the servers in the listed order: otherwise the fastest server answers.
Keep plain names local and Keep reverse lookups of private addresses local (both on by default) keep names like printer and questions about 192.168.x.x addresses on your network.
DNS rebinding protection (on by default) drops internet answers that point at private addresses. Your local domain and your domain overrides are allowed.
Cache size: 10,000 names by default; 0 turns the cache off.
Local domain and Answer the names of DHCP clients: with a local domain such as lan, every device that gets its address from the DHCP server add-in is found as name.lan. The list follows the DHCP leases by itself. A device cannot take over a name you set as a host override.
Log every query: for troubleshooting only.

Press Save, then commit.

Step 3: Overrides and redirect (optional)

Host overrides: answer a name with your own IPv4 and IPv6 addresses, for example nas.lan with 192.168.2.5, fd00:2::5. Reverse lookups of those addresses answer the name.
Domain overrides: send a domain and everything under it to other servers, for example a Windows domain corp.example to its domain controllers.
Redirect all DNS to the firewall: devices that use their own DNS servers on port 53 are answered by the forwarder instead. Choose the zones (empty: every served zone) and the DNS servers on your network to leave alone. Devices' own DNS over TLS (port 853) is not touched.

Host overrides: nas.home.lan and printer.home.lan

Domain overrides: corp.example to its own DNS server

Devices use the forwarder when DHCP hands out the firewall's address as DNS server (Network › DHCP server), or when the redirect is on.

Check it

Network › DNS forwarder › Status: dnsmasq running, the cache hit rate, the upstream servers with their queries and failures, the number of DHCP names.
Test a name: ask the forwarder as a device would.
Command line: show dns-forwarder.

Status: dnsmasq running on the firewall's internal addresses, cache hits, upstream servers

Go back to the DNS resolver

Under DNS service, choose DNS resolver (recommended) and commit. The forwarder stops and its settings stay. The DNS resolver page has the same choice.

Notes

The forwarder never hands out addresses: the DHCP server add-in (Kea) stays the DHCP server.
In a failover pair, the forwarder runs on both firewalls, like the resolver.
dnsmasq is free software (GPL-2.0) and runs as a separate program.