[Dnsmasq-discuss] Why does dnsmasq append a local domain in DNS queries?

[Mikhail Morfikov]

I have the following entries set in the dnsmasq.conf file:

# egrep -v ^# /etc/dnsmasq.conf | egrep -v "^$"
domain-needed
bogus-priv
strict-order
no-resolv
no-poll
server=127.0.2.1#5353
server=/pool.ntp.org/208.67.222.222
server=/mhouse.lh/192.168.1.1#53
local=/mhouse.lh/
listen-address=127.0.0.1
no-dhcp-interface=lo
bind-interfaces
expand-hosts
domain=mhouse.lh
cache-size=10000
min-cache-ttl=3600
max-cache-ttl=7200
dns-forward-max=1024
no-negcache

So all of the DNS requests should go to the 127.0.2.1 address, except for the two domains. One of the domains is my local one (mhouse.lh), and all
the queries should go to my network router.

The whole setup works just fine, but the problems start when I try to
visit a domain that simply doesn't exist. For instance, dupaa.com . The
following log is from tcpdump:

15:45:32.035381 IP 127.0.0.1.18520 > 127.0.2.1.5353: 1536+ A (QM)? dupaa.com. (27)
15:45:37.040620 IP 127.0.0.1.18520 > 127.0.2.1.5353: 1536+ A (QM)? dupaa.com. (27)
15:45:38.045687 IP 127.0.2.1.5353 > 127.0.0.1.18520: 1536 ServFail 0/0/1 (38)

15:45:38.046118 IP 192.168.1.150.6289 > 192.168.1.1.53: 57153+ A? dupaa.com.mhouse.lh. (37)

So the query was sent to dnsmasq, then it was passed to the local DNS
service (dnscrypt-proxy), and it failed to resolve because the domain
doesn't exist. But this wasn't the end. For some reason, there was another
query, now with the local domain appended to the actual domain. I have no
idea why this happens.

This is my /etc/resolv.conf file:

nameserver 127.0.0.1
search mhouse.lh

The IP is the dnsmasq's IP, and the search should append the domain
"mhouse.lh" to queries that don't have any domain specified, for example,
when you use just hostnames. It's very useful thing in local networks.
When I remove the "search" line, the problem disappears, but I don't have
the ability to use just hostnames anymore. I could add them to the
/etc/hosts file, but I want to avoid this.

Is there any way to solve this problem?

[Ptits de Barbe]

I believe you've wrongly interpreted the log. Let me describe how do I
understand it.

Post by Mikhail Morfikov
15:45:32.035381 IP 127.0.0.1.18520 > 127.0.2.1.5353: 1536+ A (QM)?
dupaa.com. (27)

Something running on your router sends request to 127.0.2.1:5353. It's
dnscrypt there, so that most likely was a dnsmasq request.

Post by Mikhail Morfikov
15:45:37.040620 IP 127.0.0.1.18520 > 127.0.2.1.5353: 1536+ A (QM)?
dupaa.com. (27)

Same. Have no idea why is there a second same request.

Post by Mikhail Morfikov
15:45:38.045687 IP 127.0.2.1.5353 > 127.0.0.1.18520: 1536 ServFail 0/0/1
(38)

dnscrypt responded.

Post by Mikhail Morfikov
15:45:38.046118 IP 192.168.1.150.6289 > 192.168.1.1.53: 57153+ A?
dupaa.com.mhouse.lh. (37)

And there someone from outside of the router (192.168.1._150_) queries
dnsmasq running on router.

To my knowledge, clients always requery their configured DNS with local
network suffix appended in case first query wasn't resolved. This is good,
because with small patch dnsmasq will resolve subdomains in local network
(like aba.caba.<hostname>).
Also, though I don't see further log, I suspect that there were no
requests like

Post by Mikhail Morfikov
15:45:32.035381 IP 127.0.0.1.18520 > 127.0.2.1.5353: 1536+ A (QM)?
dupaa.com.mhouse.lh. (27)

meaning dnsmasq correctly filters local network domains and doesn't query
upstream servers for them. At least your configuration looks correct.

[Mikhail Morfikov]

I believe you've wrongly interpreted the log. Let me describe how do I understand it.

Post by Mikhail Morfikov
15:45:32.035381 IP 127.0.0.1.18520 > 127.0.2.1.5353: 1536+ A (QM)? dupaa.com. (27)

Something running on your router sends request to 127.0.2.1:5353. It's dnscrypt there, so that most likely was a dnsmasq request.

Post by Mikhail Morfikov
15:45:37.040620 IP 127.0.0.1.18520 > 127.0.2.1.5353: 1536+ A (QM)? dupaa.com. (27)

Same. Have no idea why is there a second same request.

Post by Mikhail Morfikov
15:45:38.045687 IP 127.0.2.1.5353 > 127.0.0.1.18520: 1536 ServFail 0/0/1 (38)

dnscrypt responded.

Post by Mikhail Morfikov
15:45:38.046118 IP 192.168.1.150.6289 > 192.168.1.1.53: 57153+ A? dupaa.com.mhouse.lh. (37)

And there someone from outside of the router (192.168.1._150_) queries dnsmasq running on router.

Actually there are two instances of dnsmasq. The first one is installed on
my local machine and it acts just as a cache (IP 127.0.0.1). The second
one is installed on my network router (192.168.1.1). So when my machine
make a DNS query, it sends it to the local dnsmasq first. It then checks
the domain of the query and decides where to send the query next. In this
case the domain was "dupaa.com", so it should be delivered to the upstream
DNS server, in this case dnscrypt-proxy, also installed on the local host,
not the router. When it can't resolve the domain, it makes a new query, now
"dupaa.com.mhouse.lh", and it sends it to the network router because the
domain "mhouse.lh" should be answered by the network router, as configured.

This works fine, but only for domains that are valid. The problem concerns
only the domains that can't be answered by the upstream DNS server.

The log above comprise actually of two separate logs. One is from tcpdump
started on local external interface, and the other is started on loopback
(lo) interface, also on local machine, not the router. That's why there
was a space between them.

To my knowledge, clients always requery their configured DNS with local network suffix appended in case first query wasn't resolved. > This is good, because with small patch dnsmasq will resolve subdomains in local network (like aba.caba.<hostname>).

But when I remove "search mhouse.lh" from the /etc/resolv.conf file, the
problem disappears, and there's no queries that have "mhouse.lh" appended.
So when I try to make a DNS query and the domain can't be resolved by the
upstream DNS server, there's no subsequent query with the local domain
appended. I'm still able to send DNS queries to my network router, but I
have to manually append "mhouse.lh" to the hostname.

Also, though I don't see further log, I suspect that there were no requests like

That's the full log. I mean, this is what happened after trying to use
"ping dupaa.com".

Post by Mikhail Morfikov
15:45:32.035381 IP 127.0.0.1.18520 > 127.0.2.1.5353: 1536+ A (QM)? dupaa.com.mhouse.lh. (27)

meaning dnsmasq correctly filters local network domains and doesn't query upstream servers for them. At least your configuration looks correct.

So dnsmaq has nothing to do with the "dupaa.com.mhouse.lh" query? And it
just passes what it gets from the client? So the client make the request?

[w***@gmail.com]

Post by Mikhail Morfikov

Also, though I don't see further log, I suspect that there were no requests like

That's the full log. I mean, this is what happened after trying to use
"ping dupaa.com".

perhaps you should have used "ping dupaa.com." instead?

in one of my other lives we learned that if you don't also want the local domain
to be searched, you must add the trailing dot to signify that that is the end of
the domain and no additional searches should be done... we see this with all
manner of DNS clients...

just tossing that out there... maybe it will help?

[Mikhail Morfikov]

Post by w***@gmail.com

Post by Mikhail Morfikov

Also, though I don't see further log, I suspect that there were no requests like

That's the full log. I mean, this is what happened after trying to use
"ping dupaa.com".

perhaps you should have used "ping dupaa.com." instead?

I've tried to add the dot, and yes, that stops sending the another query.
That's easy to handle when you actually send a ping to an invalid
domain, or something like that. But what about all the other applications
that send many DNS requests and some of the domains simply doesn't exist?

Look at the DNS stats:

dnsmasq[1582]: time 1452266531
dnsmasq[1582]: cache size 10000, 0/2811 cache insertions re-used unexpired cache entries.
dnsmasq[1582]: queries forwarded 3205, queries answered locally 4028
dnsmasq[1582]: queries for authoritative zones 0
dnsmasq[1582]: server 192.168.1.1#53: queries sent 363, retried or failed 0
dnsmasq[1582]: server 208.67.222.222#53: queries sent 2, retried or failed 0
dnsmasq[1582]: server 127.0.2.1#5353: queries sent 2840, retried or failed 18

Most of the 363 queries that were sent to the local network router are
those with "mhouse.lh" appended to the invalid domains, and not
hostname.mhouse.lh . I'm just trying to eliminate the queries. Is there
anything I can do about it, except removing the "search" line from the
/etc/resolv.conf file?

Post by w***@gmail.com
in one of my other lives we learned that if you don't also want the local domain to be searched, you must add the trailing dot to signify that that is the end of the domain and no additional searches should be done... we see this with all manner of DNS clients...
just tossing that out there... maybe it will help?

[Ptits de Barbe]

Sorry, didn't get correct understanding of your setup from first mail,
though now it seems to have good enough description.
Anyway, I believe it is local apps (or rather a name resolving library ?)
that are issuing original query for dupaa.com.mhouse.lh, not the caching
dnsmasq on your PC. I've seen similar behavior of nslookup on Windows.
Turning on query log on local dnsmasq should prove this.
As for me, this is not a problem at all, as the query is sent to you
router and it definitely knows how to respond. However, if you'd specify
mhouse.lh as 'domain' (not 'search') option in resolv.conf, I believe the
resolving lib will append the suffix to unqualified hostnames only.

Post by Mikhail Morfikov
Actually there are two instances of dnsmasq. The first one is installed on
my local machine and it acts just as a cache (IP 127.0.0.1). The second
one is installed on my network router (192.168.1.1).

[Ptits de Barbe]

At least we can see, that query[A] dupaa.com.mhouse.lh is not
dnsmasq-initiated.

Description of ndots options in resolv.conf suggests that search paths are
always tried. And domain is always added as one of the search paths. So,
I'm afraid there is no way to disable local queries for complex domain
names.
Unless you would like to patch DNS resolver in libc, of course. :)

I've enabled the logs, but there's no visible difference between setting
"search" or "domain" to "mhouse.lh" in the /etc/resolv.conf file. In both
Jan 09 14:33:30 morfikownia dnsmasq[35363]: query[A] dupaa.com from
127.0.0.1
Jan 09 14:33:30 morfikownia dnsmasq[35363]: forwarded dupaa.com to
127.0.2.1
Jan 09 14:33:35 morfikownia dnsmasq[35363]: query[A] dupaa.com from
127.0.0.1
Jan 09 14:33:35 morfikownia dnsmasq[35363]: forwarded dupaa.com to
127.0.2.1
Jan 09 14:33:36 morfikownia dnsmasq[35363]: query[A] dupaa.com.mhouse.lh
from 127.0.0.1
Jan 09 14:33:36 morfikownia dnsmasq[35363]: forwarded
dupaa.com.mhouse.lh to 192.168.1.1