Here is an extended bind plugin

For any interested:

A couple of months ago I made some PR’s to add some features to the opnsense community bind plug-in.

Because I was adding a good number of features (and lots of code), one of the maintainers suggested that I just fork it and maintain my own.

From the README:

os-bind-rp keeps the upstream BIND plugin as its base and adds focused DNS management features:

• DNS-over-TLS (DoT) forwarders with TLS hostname verification, per-forwarder destination ports, and Forward First / Forward Only behavior.
• A DHCP lease watcher that publishes scoped dynamic DNS mappings.
• Reverse DNS zone management and optional zone notifications.
• DNSBL definitions sourced from the same lists used by Unbound.
• Listener-interface selection that follows the Unbound model, and forward-zone support.

https://github.com/resolver-plugins/plugins

I’ve been running it for about a month with no problems now.

The pipeline is automated to pull down upstream changes to the opnsense bind plug-in and combine them with what is here. Should also release new packages along with opnsense releases.

Some may or may not want it, but it bundles bind in the package, rather than depending on the version that comes with opnsense. The reason was to get some upstream bind bug fixes in here sooner..