pfSense

Using DNS64 can result in the firewall itself trying to connect to a NAT64 address. For example:

[26.03-DEVELOPMENT][admin@gw]/root: ping6 github.com
PING(56=40+8+8 bytes) 2806:db8::1 --> 64:ff9b::8c52:7203

Doing NAT64 is not useful in this case since the firewall would already have an IPv4 address to reach the IPv4-only host. However the firewall should still be allowed to connect to NAT64 addresses if another device is set up to do the NAT64 translation instead. Automatic unbound configuration should be generated when appropriate to omit NAT64 addresses for DNS queries from the firewall itself.