pfSense and OPNsense: Unbound forwarding to dnsdome over TLS

The shape of it

Both firewalls ship Unbound as the LAN resolver. Instead of letting it recurse to the root servers, you switch it to forwarding mode and give it dnsdome as the only upstream, over DNS-over-TLS. The token in your profile hostname identifies the profile, so a dynamic WAN IP never breaks filtering, and all upstream DNS leaves the firewall encrypted.

Copy the DNS-over-TLS hostname from your profile's Encrypted DNS card in the panel. It looks like <token>.dns.dnsdome.com.

pfSense

Open System → General Setup. Under DNS Server Settings add 87.244.198.165 with hostname <token>.dns.dnsdome.com, and remove any other servers. Untick DNS Server Override so the WAN's DHCP cannot inject its own. Save.
Open Services → DNS Resolver → General Settings. Tick Enable Forwarding Mode and Use SSL/TLS for outgoing DNS Queries to Forwarding Servers. Leave DNSSEC off in forwarding mode; dnsdome validates upstream.
Under Network Interfaces keep LAN selected, and under Outgoing Network Interfaces select WAN. Save and Apply Changes.
Open Services → DHCP Server → LAN and leave the DNS servers fields empty, so clients receive the firewall's LAN address as DNS. Save.

OPNsense

Open Services → Unbound DNS → DNS over TLS. Add an entry with server IP 87.244.198.165, port 853 and Verify CN <token>.dns.dnsdome.com. Save and Apply.
Open Services → Unbound DNS → General. Make sure Unbound is enabled on LAN. Do not enable Query Forwarding under the Query Forwarding tab: the DoT entries above already turn on forwarding for all names.
Open System → Settings → General. Remove any DNS servers and untick Allow DNS server list to be overridden by DHCP/PPP on WAN. Save.
Open Services → ISC DHCPv4 (or Kea) → LAN and leave DNS servers empty so clients use the firewall. Save.

Catch hard-coded DNS

Add a NAT port forward on LAN: protocol TCP/UDP, destination any port 53, redirect target the firewall's LAN address port 53. Tick the option to create the matching filter rule. In pfSense this is Firewall → NAT → Port Forward; in OPNsense Firewall → NAT → Port Forward as well. Optionally add a LAN rule rejecting outbound TCP 853 so devices cannot use their own DoT provider.

Verify

On the firewall's Diagnostics → DNS Lookup, query doubleclick.net. With Ads & Tracking enabled the answer is the block response. From a client, nslookup doubleclick.net gives the same, and the query shows in the panel's log under your profile within a minute. Under Diagnostics → States, filter for port 853 to see the TLS session to 87.244.198.165.

Why not keep Unbound recursing and use dnsdome only for some hosts?

Filtering has to see every query to be useful. Forward everything and use dnsdome's allowlist for the few domains you want unblocked; it is one line per domain in the panel.

Can different VLANs get different policies?

Not through a single Unbound, which has one upstream for every interface. Create one dnsdome profile per VLAN, run a small forwarder per VLAN with that profile's DoT hostname as upstream, and hand each VLAN its forwarder through DHCP. Phones and laptops can instead carry their own per-device endpoint, which works on any VLAN and away from home.