pfSense

Presently, local services do not use the DNS forwarder (if enabled).

The solution (recommended by the dnsmasq manpage) is to put
nameserver 127.0.0.1
"as the first line [in resolv.conf], followed by the upstream nameservers. dnsmasq is smart enough to ignore this line and forward all queries appropriately, while all other applications will send all their queries to dnsmasq." (quote from the debian howto for dnsmasq).

Its especially useful in tandem with transparent squid. the clients' browsers issue the first lookup, which is then in cache. Without the 127.0.0.1 line in resolve.conf, the upstream nameservers get queried again when squid makes the actual http request.

Its also useful for gui-based diagnostics, since the gui frontend for nslookup then reveals what clients see (and what they aren't seeing), not what the local services see.

As a workaround its possible to put localhost as the first entry in System:General Setup:DNS servers, but that consumes one slot in the list.