Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to use pfsense as caching DNS server. It will resolve domains starting from root servers and will cache them for consequent hits.

I tried DNS servers package on pfsense 1.2.2, which I guess uses WAN dns serversby default.

share|improve this question
up vote 0 down vote accepted


The current versions of pfSense (2.2+) are now based on FreeBSD 10.X. This includes Unbound as the resolver. You can point Unbound at the resolvers at OpenDNS or Google.

[True for pfSense 2.1 and lower]

pfsense has a DNS cache, it is called dnsmasq. It doesn't start from the root servers. By default, it will take the DNS from the WAN DHCP server, but you can override that from the web page. I would point the box to an open DNS server, like

Google's at, Level3 at, OpenDNS at,

The root servers are busy, so I wouldn't suggest starting with them. Use the addresses above and you should get better performance.


Based on the comment below that states that dnsmasq is not a cache (not true, dnsmasq does cache responses, just not all types of records, see dnsmasq), I'd like to point out that there is another package on pfSense that does full DNS caching. Unbound is a full DNS resolver with support for DNSSEC (signed DNS requests). If you want a "full and complete" DNS cache, install that instead of using dnsmasq (which comes by default).

NOTE: There is one thing to be aware of when using Unbound. During an upgrade to the system, if you have pfSense itself set to only use Unbound as a resolver, DNS will fail because the packages are not be installed until after the OS is installed (but the OS upgrade requires DNS to get the packages). In this case, make sure that there are backup DNS resolvers for pfSense to use during an upgrade.

share|improve this answer
this is a workaround, but not suitable for my situation. btw thanks. – dereli Jan 21 '10 at 9:18
this should not be the accepted answer, dnsmasq does not cache responses – levinalex Jul 12 '14 at 18:41
According to, dnsmasq does do caching of common DNS responses. Think of it as a stripped down DNS cache. – Walter Jul 28 '14 at 23:01
UPDATE: the current version of pfSense (2.2.X) uses Unbound as the resolver and not dnsmasq. – Walter Mar 31 '15 at 18:32

A pfSense forum thread suggests installing the DNS package for tinydns, and then adjusting the cache size to suit your needs.

share|improve this answer
This did not work for my case. – dereli Nov 23 '09 at 6:42
Why did it not work? – Zanchey Nov 23 '09 at 7:26
By "did not work", I meant DNS server did not resolve host names. – dereli Nov 24 '09 at 14:49
TinyDNS is an authoritative DNS server only. The DJBDNS package that it came from has a separate program that does recursive DNS called dnscache. A 'caching DNS server' is usually what people call something like BIND without any local domains. – Walter Dec 30 '09 at 22:03

You can use the Unbound pacakge for this.

share|improve this answer
I used this. Works very well on pfsense 2.1 – levinalex Jul 12 '14 at 18:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.