Unbound: enable dnstap support
dnstap support in Unbound would allow for query logging from pfSense with minimal performance impact. To implement a full (remote) query logging solution, additional packages will be required, but turning on
--enable-dnstap for the build is a prerequisite. Advanced administrators could then add additional binaries to their installation to generate dnstap-based remote query logging. At some time in the future, remote query logging packages and GUI could be added.
dnstap support has been in Unbound for 5 years, since 1.5.0 and seen support and bugfixes over that time, despite the lack of documentation of the
dnstap: clause in the unbound.conf manpage.