DNS Resolver (Unbound)
Unbound has similar protections to dnsmasq, using its “Private Address support” option. With that option enabled RFC1918 addresses are stripped away from DNS answers. Additionally, the DNSSEC validator may mark the answers bogus.
Individual domains can be excluded from DNS rebinding protection using the Custom Options on the Unbound general settings. Enter one domain per line in the following format, preceded by the “server:” line.
server:private-domain:"plex.direct"https://www.netgate.com/docs/pfsense/dns/dns-rebinding-protections.html