DNS

pfSense's DNS Resolver (Unbound) is the authoritative internal resolver for devhome.cloud, with two extra jobs: split-horizon routing of Azure-specific lookups, and controlled external access for Azure's own resolvers to reach it.

Domain Overrides → Azure DNS Resolver

Azure Private DNS zones (privatelink.his.arc.azure.com, privatelink.azurecr.io, private.westus3.azmk8s.io, etc.) only resolve correctly through Azure's own DNS infrastructure. A Domain Override sends queries for these specific zones to the Azure DNS Resolver's inbound endpoint (in the 172.16.0.0/28 inbound subnet of the hub VNet) over the IPsec tunnel, instead of Unbound trying to resolve them itself. Everything else resolves locally as normal.

Host Overrides

Manually pinned A records for services whose IP isn't (or shouldn't be) discovered via DHCP registration — ArgoCD, Rancher, the container registry, and similar ingress/LB addresses. These need a manual update any time the underlying LoadBalancer IP changes (e.g. after a MetalLB pool change) — see Bootstrapping a New Cluster.

Access Lists for Azure

For the outbound direction — Azure's Hub Networks resolver needing to query back into the lab's DNS Resolver (e.g. for on-prem name resolution from Arc-connected resources) — an access list on the DNS Resolver permits queries from the hub's outbound subnet (172.16.0.16/28). Without this, Unbound just refuses the query rather than failing loudly, which makes it look like a routing problem rather than an ACL problem.

Kea DHCP-lease DNS registration

Separate from the resolver's own config — see DHCP & PXE Boot for the dnsreg flag that controls whether DHCP leases actually get registered into DNS at all under Kea.