<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.E-MailFormatvorlage18
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=DE link=blue vlink=purple style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>I think defining a local CNAME for e.g. nxdomain.example.com with just a dot should be close to what you want to achieve. Did this on my pi-hole just now. Or what am I missing?<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'>Regards, Joachim<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>Von:</span></b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'> Dnsmasq-discuss <dnsmasq-discuss-bounces@lists.thekelleys.org.uk> <b>Im Auftrag von </b>Indronil Anik<br><b>Gesendet:</b> Donnerstag, 17. September 2026 13:13<br><b>An:</b> dnsmasq-discuss@lists.thekelleys.org.uk<br><b>Betreff:</b> Re: [Dnsmasq-discuss] NXDOMAIN responses and negative TTL/SOA<o:p></o:p></span></p></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Small correction to my example in the previous email:<br><br>I mistakenly used `/<a href="http://example.com/#`">example.com/#`</a> as the example. That returns a null IP address, not NXDOMAIN.<br><br>What I actually meant was a blocking rule like:<br><br>/<a href="http://example.com/">example.com/</a><br><br>in the dnsmasq Forward section, which returns NXDOMAIN for all queries.<br><br>My question is specifically about these locally generated NXDOMAIN responses: since they don't contain an SOA record or negative TTL, the client can't negatively cache the response and may keep querying dnsmasq repeatedly for the same domain.<br><br>Another thing is that I don't just want to block A and AAAA queries. Nowadays, HTTPS records are also used, and for some domains they can contain IPv4 and IPv6 address hints. If HTTPS records for blocked domains are not blocked, some clients may use the IPs received from those hints and still successfully connect to those domains.<br><br>The Chrome team has also said they have plans to add support for IPv4 and IPv6 hints in their browser.<br><br>`/<a href="http://example.com/%60">example.com/`</a> blocks everything with NXDOMAIN, so it is ideal for me to block all three: A, AAAA, and HTTPS. However, dnsmasq not providing an SOA/negative TTL to the client is somewhat of an issue.<br><br>So, please let me know if there are any plans to implement this kind of fake SOA/negative TTL support in dnsmasq.<br><br>Sorry for making the mistake in my initial email.<br><br>Thanks,<br><br>Indronil.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>On Thu, Sep 17, 2026 at 3:19<span style='font-family:"Arial",sans-serif'> </span>PM Indronil Anik <<a href="mailto:indronilanik@gmail.com">indronilanik@gmail.com</a>> wrote:<o:p></o:p></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'><p class=MsoNormal>Hello everyone,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I have a question about locally generated NXDOMAIN responses in dnsmasq.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I came across this older discussion from 2018:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><a href="https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2018q1/012042.html" target="_blank">https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2018q1/012042.html</a><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The answer mentioned that providing TTL information for locally generated NXDOMAIN responses would require dnsmasq to include an SOA record.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>It's been 8 years since that email, and I was wondering if anything has changed since then?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>For example, currently with a blocking rule like:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>/<a href="http://example.com/" target="_blank">example.com/#</a><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>dnsmasq returns NXDOMAIN, but there is no SOA record or negative TTL in the response. Because of that, the client doesn't have anything to use for negative caching, and some stubborn clients or apps keep querying dnsmasq again and again for the same domain, which fills the log with a lot of clutter.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Would you please consider adding SOA records with TTL as a feature?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>For context, I'm using dnsmasq-full on OpenWrt in my router.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Indronil.<o:p></o:p></p></blockquote></div></body></html>