MT3000: Beryl AX Wi-FI 5G Wireguard DNS OPNsense

The nameserver can not be a domain; it needs to be an IP for dnsmasq.
To enable forwarding a non-FQDN, you can edit dnsmasq option, uncheck this for vpn dnsmasq instance:

http://192.168.8.1/cgi-bin/luci/admin/network/dhcp