1

Most DNS queries for top-level domains from my LAN behind a router with dnsmasq 2.55 on OpenWRT 10.03.1 return negative results, e.g.:

$ dig com. ANY

; <<>> DiG 9.7.3 <<>> com. ANY
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 36108
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;com.               IN  ANY

;; Query time: 3 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Tue Feb 12 22:37:30 2013
;; MSG SIZE  rcvd: 21

When using some external recursive server (e.g. dig com. ANY @8.8.8.8), the query result is successful.

I thought that the problem migh be that dnsmasq considers the query for .com as a query for unqualified name com (terminal . seems to be always stripped). But even when dnsmasq is configured to forward queries for com comains and undistinguished names:

server=/com/8.8.8.8,server=//8.8.8.8

results are the same.

However, some types of queries actually DO pass, like NS or SOA. Some other, which DO NOT pass and return NOXDOMAIN, besides ANY, are e.g. DNSKEY or RRSIG.

Corresponding lines from the dnsmasq log are:

Feb 12 21:41:13 myrouter daemon.info dnsmasq[11569]: using nameserver 8.8.8.8#53 for unqualified names
...
Feb 12 21:42:52 myrouter daemon.debug dnsmasq[11569]: query[DNSKEY] com from 192.168.1.5
Feb 12 21:42:52 myrouter daemon.debug dnsmasq[11569]: config com is NXDOMAIN
...
Feb 12 21:43:06 myrouter daemon.debug dnsmasq[11569]: query[NS] com from 192.168.1.5
Feb 12 21:43:06 myrouter daemon.debug dnsmasq[11569]: forwarded com to 8.8.8.8

I wonder if, and how, can be dnsmasq configured to return expected results fot those queries. (queries for "normal" hostnames work properly)

Improve this question

2 Answers 2

Reset to default
2

You probably have the domain-needed option enabled:

  -D, --domain-needed

Tells dnsmasq to never forward A or AAAA queries for plain names, without dots or domain parts, to upstream nameservers. If the name is not known from /etc/hosts or DHCP then a "not found" answer is returned.

Find where this is set (either /etc/dnsmasq.conf or the command line parameters) and remove it.

Improve this answer
3
  • this dnsmasq really has -D option (though not defined in /etc/dnsmasq.conf, but in /etc/init.d/dnsmasq) and disabling it fixes the problem, however it is a good idea to use it to prevent some information leakage, so i wonder if the problem can be solved without disabling the -D param (to work for real TLDs, not for random names) .. interesting is that it is also blocking some other queries than A or AAAA..
    – mykhal
    Feb 12, 2013 at 22:51
  • i.stack.imgur.com/1CoCt.png
    – Michael Hampton
    Feb 13, 2013 at 0:53
  • Michael, i insist that com. IS a DNS name :)
    – mykhal
    Feb 13, 2013 at 1:25
0

I guess the problem is with the domain regex. This worked for me.

Just remove the regex over the domain: server=8.8.8.8#53

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .