pfSense

At the moment it allows all local-connected subnets, including WAN/s. For example in some of my situations we have a rooftop ISP wireless device which connects to their tower. All the small businesses connected to the tower can reach each other - the ISP does nothing to lock that down. So it would be nicer if my pfSense unbound did not allow any incoming queries on the WAN (public IP) interface.
(Yes, I realize that the firewall rules prevent that anyway, but we are thinking here about what happens when the network admin has put some "dumb" pass rule in place)
1) The code could just put entries for locally-connected non-WAN-style interfaces. That is probably the most fully-locked-down thing, and make people with static routes and VPNs to other parts of their intranet add those in the DNS Resolver, Access Lists page.
or
2) Otherwise, for IPv4, it seems reasonable to put all the private address space by default and that will help 99.9% of users, and not expose any DNS resolver to the public internet. Then also have code to add all locally-connected non-WAN-style interfaces that are not already in private address space, so people with public subnets inside their pfSense will have those work with DNS resolver for free.

Neither should be difficult to code.

one update to use the same list of networks as automatic outbound NAT uses, that's the best internal networks list that exists for v4.