Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Most DNS queries for top-level domains from my LAN behind a router with dnsmasq 2.55 on OpenWRT 10.03.1 return negative results, e.g.:

$ dig com. ANY

; <<>> DiG 9.7.3 <<>> com. ANY
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 36108
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;com.               IN  ANY

;; Query time: 3 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Tue Feb 12 22:37:30 2013
;; MSG SIZE  rcvd: 21

When using some external recursive server (e.g. dig com. ANY @8.8.8.8), the query result is successful.

I thought that the problem migh be that dnsmasq considers the query for .com as a query for unqualified name com (terminal . seems to be always stripped). But even when dnsmasq is configured to forward queries for com comains and undistinguished names:

server=/com/8.8.8.8,server=//8.8.8.8

results are the same.

However, some types of queries actually DO pass, like NS or SOA. Some other, which DO NOT pass and return NOXDOMAIN, besides ANY, are e.g. DNSKEY or RRSIG.

Corresponding lines from the dnsmasq log are:

Feb 12 21:41:13 myrouter daemon.info dnsmasq[11569]: using nameserver 8.8.8.8#53 for unqualified names
...
Feb 12 21:42:52 myrouter daemon.debug dnsmasq[11569]: query[DNSKEY] com from 192.168.1.5
Feb 12 21:42:52 myrouter daemon.debug dnsmasq[11569]: config com is NXDOMAIN
...
Feb 12 21:43:06 myrouter daemon.debug dnsmasq[11569]: query[NS] com from 192.168.1.5
Feb 12 21:43:06 myrouter daemon.debug dnsmasq[11569]: forwarded com to 8.8.8.8

I wonder if, and how, can be dnsmasq configured to return expected results fot those queries. (queries for "normal" hostnames work properly)

share|improve this question

1 Answer 1

You probably have the domain-needed option enabled:

  -D, --domain-needed

Tells dnsmasq to never forward A or AAAA queries for plain names, without dots or domain parts, to upstream nameservers. If the name is not known from /etc/hosts or DHCP then a "not found" answer is returned.

Find where this is set (either /etc/dnsmasq.conf or the command line parameters) and remove it.

share|improve this answer
    
this dnsmasq really has -D option (though not defined in /etc/dnsmasq.conf, but in /etc/init.d/dnsmasq) and disabling it fixes the problem, however it is a good idea to use it to prevent some information leakage, so i wonder if the problem can be solved without disabling the -D param (to work for real TLDs, not for random names) .. interesting is that it is also blocking some other queries than A or AAAA.. –  mykhal Feb 12 '13 at 22:51
    
    
Michael, i insist that com. IS a DNS name :) –  mykhal Feb 13 '13 at 1:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.