Right now I've got the following line in dnsmasq.conf, which handles well all requests (/#/ matches any domain; this is required):


Yet, there are some domains which require to be resolved to IP addresses other than

As temporary solution they have been added to /etc/hosts:   ajax.googleapis.com  underscorejs.org    s3.amazonaws.com

Unfortunately this is a very temporary solution: it will stop working as soon the IP address of any target domain changes.

My question is: how to enforce dnsmasq to use an upstream dns server for resolving the IP addresses of some (specified) domain names?


You can do this by using the server= directive e.g.


would query the google public DNS server for the ajax.googleapis.com domain, similarly


would query Level3's public DNS server for the amazonaws.com domain.

You can group multiple domains together


Would send the .co.uk and .com domains to the DNS server at

You can have multiple server= directives too

−S, --server=[/[<domain>]/[domain/]][<ipaddr>[#<port>][@<source>[#<port>]]]

Specify IP address of upstream severs directly. Setting this flag does not suppress reading of /etc/resolv.conf, use -R to do that. If one or more optional domains are given, that server is used only for those domains and they are queried only using the specified server. This is intended for private nameservers: if you have a nameserver on your network which deals with names of the form xxx.internal.thekelleys.org.uk at then giving the flag -S /internal.thekelleys.org.uk/ will send all queries for internal machines to that nameserver, everything else will go to the servers in /etc/resolv.conf. An empty domain specification, // has the special meaning of "unqualified names only" ie names without any dots in them. A non-standard port may be specified as part of the IP address using a # character. More than one -S flag is allowed, with repeated domain or ipaddr parts as required.

Also permitted is a -S flag which gives a domain but no IP address; this tells dnsmasq that a domain is local and it may answer queries from /etc/hosts or DHCP but should never forward queries on that domain to any upstream servers. local is a synonym for server to make configuration files clearer in this case.

The optional second IP address after the @ character tells dnsmasq how to set the source address of the queries to this nameserver. It should be an address belonging to the machine on which dnsmasq is running otherwise this server line will be logged and then ignored. The query-port flag is ignored for any servers which have a source address specified but the port may be specified directly as part of the source address.

| improve this answer | |
  • I don't think he needs multiple server lines: whatever addresses he wants to fail to resolve (, he can add them in with address lines; anything else, DNSMasq will query the server. Pretty sure that's how mine's setup. – gravyface Aug 24 '12 at 11:50
  • 1
    @gravyace: I read the question as wanting to make everything resolve to with some exceptions which he wants to use DNS to resolve in case they change address.As I see it the way to do this is to use server directives. – user9517 Aug 24 '12 at 12:23
  • Oh maybe. Who knows. Either way, that should get him going. – gravyface Aug 24 '12 at 12:28
  • Works like a charm! – nrph Aug 24 '12 at 20:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.