Debugging a DNSmasq server using it's logs, I find a LOT of:
dnsmasq: query[ANY] . from RANDOM-IP dnsmasq: query[ANY] . from RANDOM-IP dnsmasq: query[ANY] . from RANDOM-IP dnsmasq: query[ANY] . from RANDOM-IP
All legitimate queries seem to be more specific, like:
dnsmasq: query[A] specificdomain.com from KNOWN-IP
EDIT: This is NOT intended as a public DNS service
We want to create a white-list DNS filter, it should ONLY answer to a list of specified domains. Typical amplification attacks would only affect our server, nobody else. We just want a cleaner log to be able to operate better.
The intended operation is:
- Client uses this DNS for their internet connection.
- Client requests domain resolution
- If the domain is in the white-list, we resolve, if not, we don't reply.
How can we achieve this? Only process request that match our white-list, discard anything else.