Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I query the ISP's DNS server for, it comes back with something like this:


(note that the IP address is a local one)

When I do the same over DNSMasq, the response is empty; the A record is missing. It works fine for every other address I've tried.

What is this, a mis-configuration of DNSMasq, a bug, or expected behaviour?

share|improve this question
up vote 4 down vote accepted

You probably have dnsmasq's rebind protection enabled with this option:

          Reject (and log) addresses from upstream nameservers  which  are
          in  the private IP ranges. This blocks an attack where a browser
          behind a firewall  is  used  to  probe  machines  on  the  local

You can disable this entirely by removing this option, or you can whitelist certain domains using this option:
share|improve this answer
Thanks. Same problem as OP, using public DNS to store internal IPs. Couldn't understand why dig -t ANY would give me a proper A record, but plain dig (e.g. dig -t A) would give me nothing. Also couldn't understand why it only was an issue intermittently: it was only when I was connected to a network using dnsmasq. – Jesse Buchanan Apr 4 '14 at 16:03

I think it could be Bind9 view feature, especially if your DNSMasq is not in the same ip range as your PC

The view statement is a powerful new feature of BIND 9 that lets a name server answer a DNS query differently depending on who is asking (...) more

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.