Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When I query the ISP's DNS server for foo.example.com, it comes back with something like this:

;; ANSWER SECTION:
foo.example.com. 159 IN A       192.168.40.20

(note that the IP address is a local one)

When I do the same over DNSMasq, the response is empty; the A record is missing. It works fine for every other address I've tried.

What is this, a mis-configuration of DNSMasq, a bug, or expected behaviour?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

You probably have dnsmasq's rebind protection enabled with this option:

   --stop-dns-rebind
          Reject (and log) addresses from upstream nameservers  which  are
          in  the private IP ranges. This blocks an attack where a browser
          behind a firewall  is  used  to  probe  machines  on  the  local
          network.

You can disable this entirely by removing this option, or you can whitelist certain domains using this option:

--rebind-domain-ok=example.com
share|improve this answer
    
Thanks. Same problem as OP, using public DNS to store internal IPs. Couldn't understand why dig -t ANY would give me a proper A record, but plain dig (e.g. dig -t A) would give me nothing. Also couldn't understand why it only was an issue intermittently: it was only when I was connected to a network using dnsmasq. –  Jesse Buchanan Apr 4 at 16:03

I think it could be Bind9 view feature, especially if your DNSMasq is not in the same ip range as your PC

The view statement is a powerful new feature of BIND 9 that lets a name server answer a DNS query differently depending on who is asking (...) more

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.