Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Most DNS queries for top-level domains from my LAN behind a router with dnsmasq 2.55 on OpenWRT 10.03.1 return negative results, e.g.:

$ dig com. ANY

; <<>> DiG 9.7.3 <<>> com. ANY
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 36108
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;com.               IN  ANY

;; Query time: 3 msec
;; WHEN: Tue Feb 12 22:37:30 2013
;; MSG SIZE  rcvd: 21

When using some external recursive server (e.g. dig com. ANY @, the query result is successful.

I thought that the problem migh be that dnsmasq considers the query for .com as a query for unqualified name com (terminal . seems to be always stripped). But even when dnsmasq is configured to forward queries for com comains and undistinguished names:


results are the same.

However, some types of queries actually DO pass, like NS or SOA. Some other, which DO NOT pass and return NOXDOMAIN, besides ANY, are e.g. DNSKEY or RRSIG.

Corresponding lines from the dnsmasq log are:

Feb 12 21:41:13 myrouter dnsmasq[11569]: using nameserver for unqualified names
Feb 12 21:42:52 myrouter daemon.debug dnsmasq[11569]: query[DNSKEY] com from
Feb 12 21:42:52 myrouter daemon.debug dnsmasq[11569]: config com is NXDOMAIN
Feb 12 21:43:06 myrouter daemon.debug dnsmasq[11569]: query[NS] com from
Feb 12 21:43:06 myrouter daemon.debug dnsmasq[11569]: forwarded com to

I wonder if, and how, can be dnsmasq configured to return expected results fot those queries. (queries for "normal" hostnames work properly)

share|improve this question

You probably have the domain-needed option enabled:

  -D, --domain-needed

Tells dnsmasq to never forward A or AAAA queries for plain names, without dots or domain parts, to upstream nameservers. If the name is not known from /etc/hosts or DHCP then a "not found" answer is returned.

Find where this is set (either /etc/dnsmasq.conf or the command line parameters) and remove it.

share|improve this answer
this dnsmasq really has -D option (though not defined in /etc/dnsmasq.conf, but in /etc/init.d/dnsmasq) and disabling it fixes the problem, however it is a good idea to use it to prevent some information leakage, so i wonder if the problem can be solved without disabling the -D param (to work for real TLDs, not for random names) .. interesting is that it is also blocking some other queries than A or AAAA.. – mykhal Feb 12 '13 at 22:51
Michael, i insist that com. IS a DNS name :) – mykhal Feb 13 '13 at 1:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.