[Dnsmasq-discuss] NXDOMAIN responses and negative TTL/SOA

[Indronil Anik]

Small correction to my example in the previous email:

I mistakenly used `/example.com/#` as the example. That returns a null IP
address, not NXDOMAIN.

What I actually meant was a blocking rule like:

/example.com/

in the dnsmasq Forward section, which returns NXDOMAIN for all queries.

My question is specifically about these locally generated NXDOMAIN
responses: since they don't contain an SOA record or negative TTL, the
client can't negatively cache the response and may keep querying dnsmasq
repeatedly for the same domain.

Another thing is that I don't just want to block A and AAAA queries.
Nowadays, HTTPS records are also used, and for some domains they can
contain IPv4 and IPv6 address hints. If HTTPS records for blocked domains
are not blocked, some clients may use the IPs received from those hints and
still successfully connect to those domains.

The Chrome team has also said they have plans to add support for IPv4 and
IPv6 hints in their browser.

`/example.com/` blocks everything with NXDOMAIN, so it is ideal for me to
block all three: A, AAAA, and HTTPS. However, dnsmasq not providing an
SOA/negative TTL to the client is somewhat of an issue.

So, please let me know if there are any plans to implement this kind of
fake SOA/negative TTL support in dnsmasq.

Sorry for making the mistake in my initial email.

Thanks,

Indronil.

On Thu, Sep 17, 2026 at 3:19 PM Indronil Anik <indronilanik at gmail.com>
wrote:

> Hello everyone,
>
> I have a question about locally generated NXDOMAIN responses in dnsmasq.
>
> I came across this older discussion from 2018:
>
>
> https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2018q1/012042.html
>
> The answer mentioned that providing TTL information for locally generated
> NXDOMAIN responses would require dnsmasq to include an SOA record.
>
> It's been 8 years since that email, and I was wondering if anything has
> changed since then?
>
> For example, currently with a blocking rule like:
>
> /example.com/#
>
> dnsmasq returns NXDOMAIN, but there is no SOA record or negative TTL in
> the response. Because of that, the client doesn't have anything to use for
> negative caching, and some stubborn clients or apps keep querying dnsmasq
> again and again for the same domain, which fills the log with a lot of
> clutter.
>
> Would you please consider adding SOA records with TTL as a feature?
>
> For context, I'm using dnsmasq-full on OpenWrt in my router.
>
> Thanks,
>
> Indronil.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/attachments/20260917/4cf93caa/attachment.htm>