<div dir="ltr">Richard,<div><br></div><div>I believe I have the exact same requirements if I am reading this correctly, and I have not found a solution either. If you do please let me know!</div><div><br></div><div>This was my post a while back </div><div>//// start ////</div><div><br></div><div><span style="font-size:12.8px">I have a setup currently where I have a VPN that is transient, but when it is connected, I need to query the on-net DNS server for `domain.tld` to hit `secure(s).domain.tld` but when the VPN is disconnected I need to continue to query the public DNS servers for the normal `public.domain.tld` records as per normal. </span><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">I've tried just leaving, hoping that after timeouts to the more specific</div><div style="font-size:12.8px">server=/domain.tld/q.w.e.r</div><div style="font-size:12.8px"><span class="">dnsmasq</span> would fall back to the more generally defined</div><div style="font-size:12.8px">server=a.b.c.d</div><div style="font-size:12.8px">But that wasn't the case</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">I also tried using</div><div style="font-size:12.8px">strict-order</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">But that did not do it either;</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">I realize I could set:</div><div style="font-size:12.8px">strict-order<br></div><div style="font-size:12.8px">server=/domain.tld/q.w.e.r<br></div><div style="font-size:12.8px">server=/domain.tld/a.b.c.d<br></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">But was just wondering if there was a more elegant way?</div></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">//// end ////</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">And I actually ended up trying the strict route ordering, and that did not work either, If the domain.tld servers fail the entire domain.tld becomes unresolvable; that is the default nameserver is not tried.</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Wondering if you or anyone else has a solution here?</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">In the meantime what I did was add a static host entry for the vpn.domain.tld on my vpn endpoint so that at least it could resolve that host. Not ideal, but ok for now in my situation.</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">-Eric</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Dec 1, 2015 at 10:02 PM, Richard Hansen <span dir="ltr"><<a href="mailto:rhansen@bbn.com" target="_blank">rhansen@bbn.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 2015-12-02 00:44, Richard Hansen wrote:<br>
> Is it possible to configure dnsmasq to try the next server in<br>
> /etc/resolv.conf if it gets a "refused" answer?<br>
<br>
</span>I just noticed these bits from CHANGELOG.archive:<br>
<br>
version 2.21<br>
Improve handling of SERVFAIL and REFUSED errors. Receiving<br>
these now initiates search for a new good server, and a<br>
server which returns them is not a candidate as a good<br>
server.<br>
<br>
version 2.24<br>
Tweak behaviour on receipt of REFUSED or SERVFAIL rcodes,<br>
now the query gets retried on all servers before returning<br>
the error to the source of the query.<br>
<br>
This is the exact behavior I want, except for the part where REFUSED<br>
causes the server to be "not a candidate as a good server." (Just<br>
because the server is a bad choice for that particular query doesn't<br>
mean it's bad for all queries.)<br>
<br>
I'm using dnsmasq version 2.68, so I'll run some more tests to see if I<br>
can figure out why things aren't behaving as expected. (tcpdump shows<br>
it giving up immediately when it gets a REFUSED.) Could the behavior<br>
I'm seeing be caused by --strict-order?<br>
<div class="HOEnZb"><div class="h5"><br>
Thanks,<br>
Richard<br>
<br>
_______________________________________________<br>
Dnsmasq-discuss mailing list<br>
<a href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk">Dnsmasq-discuss@lists.thekelleys.org.uk</a><br>
<a href="http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss" rel="noreferrer" target="_blank">http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss</a><br>
</div></div></blockquote></div><br></div>