When you disabling forwarding, you use kresd, when you enable forwarding, you use ISPs DNS. Isnt it that way?