pfSense

That's a limitation of Unbound when binding to specific interfaces/addresses or when acting as a DNS over TLS server.

We do this when binding to all and DoT is off:

       interface-automatic: <yes or no>
              Listen  on all addresses on all (current and future) interfaces,
              detect the source interface on UDP  queries  and  copy  them  to
              replies.   This  is  a  lot like ip-transparent, but this option
              services all interfaces whilst with ip-transparent you  can  se-
              lect  which  (future)  interfaces  Unbound  provides service on.
              This feature is experimental, and needs support in your  OS  for
              particular socket options.  Default value is no.

It's not compatible with other configurations.

I thought I reopened this but apparently not. Based on my last comment, this needs some more testing and confirmation that the behavior has been fixed in Unbound. If it has, then we can remove the condition that prevents using DoT and interface-automatic at the same time.

https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/889

Applied in changeset 910a468672a6dcfe9f3567ffcb25e0fd94e74073.

• If Network Interfaces is set to all, unbound will respond from the wrong address unless interface-automatic: yes is set.
• If Network Interfaces is set to specific interfaces, unbound will respond from the correct address regardless of interface-automatic (tested set/unset and yes/no).
• If interface-automatic: yes is set, unbound will listen on all (e.g. *:53) regardless of the interface (aka Network Interfaces) option.

The following patch addresses this behavior and always respects the Network Interfaces option:

diff --git a/src/etc/inc/unbound.inc b/src/etc/inc/unbound.inc
index 2da497cd12..bbaa7aa332 100644
--- a/src/etc/inc/unbound.inc
+++ b/src/etc/inc/unbound.inc
@@ -257,15 +257,14 @@ EOF;
     // Determine interfaces where unbound will bind
     $port = (is_port($unboundcfg['port'])) ? $unboundcfg['port'] : "53";
     $tlsport = is_port($unboundcfg['tlsport']) ? $unboundcfg['tlsport'] : "853";
-    $bindintcfg = "interface-automatic: yes" . PHP_EOL;
-    if (isset($unboundcfg['enablessl'])) {
-        $bindintcfg .= sprintf('interface-automatic-ports: "%1$s %2$s"%3$s', $port, $tlsport, PHP_EOL);
-    }
+    $bindintcfg = "";
     $bindints = array();
     $active_interfaces = explode(",", $unboundcfg['active_interface']);
     if (empty($unboundcfg['active_interface']) || in_array("all", $active_interfaces, true)) {
-        $bindints[] = "0.0.0.0";
-        $bindints[] = "::0";
+        $bindintcfg = "interface-automatic: yes" . PHP_EOL;
+        if (isset($unboundcfg['enablessl'])) {
+            $bindintcfg .= sprintf('interface-automatic-ports: "%1$s %2$s"%3$s', $port, $tlsport, PHP_EOL);
+        }
     } else {
         foreach ($active_interfaces as $ubif) {
             /* Do not bind to disabled/nocarrier interfaces,
@@ -533,7 +532,7 @@ aggressive-nsec: {$aggressivensec}
 {$statistics}
 # TLS Configuration
 {$tlsconfig}
-# Interface IP(s) to bind to
+# Interface IP addresses to bind to
 {$bindintcfg}
 {$outgoingints}
 # DNS Rebinding

https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/918

Applied in changeset c77e381e5c408172cb20a565a3fdfd998fc983d1.