I use a public DNS provider (nextdns.io) that blocks some domains. These blocked domains return a response like this when
; <<>> DiG 9.16.1-Ubuntu <<>> example.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63541 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;example.com. IN A ;; Query time: 66 msec ;; SERVER: 192.168.1.1#53(192.168.1.1) ;; WHEN: Wed Jul 22 12:03:25 CDT 2020 ;; MSG SIZE rcvd: 33
I use dnsmasq on a DD-WRT router to handle all DNS queries from devices on the local network. Is there a way to configure dnsmasq to cache these
NOERROR results with 0
Viewing logs, I can tell that my upstream DNS provider continues to get hammered by a client on my network trying to access some blocked domains frequently.
I explored the dnsmasq manpage, but the cache/ttl flags I see do not seem to have an effect on these types of responses since they are not negative (e.g.
NXDOMAIN) cacheable but are just no answer at all. I know that I could explicitly handle certain domains in my dnsmasq config by adding records like
address=/.example.com/::, but I'd prefer to add a cache/ttl at my dnsmasq to cache no answers for something like 300 seconds before trying to query for an answer from upstream again.