[Dnsmasq-discuss] NXDOMAIN responses and negative TTL/SOA

[Joachim Lindenberg]

I think defining a local CNAME for e.g. nxdomain.example.com with just a dot should be close to what you want to achieve. Did this on my pi-hole just now. Or what am I missing?

Regards, Joachim

 

Von: Dnsmasq-discuss <dnsmasq-discuss-bounces at lists.thekelleys.org.uk> Im Auftrag von Indronil Anik
Gesendet: Donnerstag, 17. September 2026 13:13
An: dnsmasq-discuss at lists.thekelleys.org.uk
Betreff: Re: [Dnsmasq-discuss] NXDOMAIN responses and negative TTL/SOA

 

Small correction to my example in the previous email:

I mistakenly used `/example.com/#` <http://example.com/#`>  as the example. That returns a null IP address, not NXDOMAIN.

What I actually meant was a blocking rule like:

/example.com/ <http://example.com/> 

in the dnsmasq Forward section, which returns NXDOMAIN for all queries.

My question is specifically about these locally generated NXDOMAIN responses: since they don't contain an SOA record or negative TTL, the client can't negatively cache the response and may keep querying dnsmasq repeatedly for the same domain.

Another thing is that I don't just want to block A and AAAA queries. Nowadays, HTTPS records are also used, and for some domains they can contain IPv4 and IPv6 address hints. If HTTPS records for blocked domains are not blocked, some clients may use the IPs received from those hints and still successfully connect to those domains.

The Chrome team has also said they have plans to add support for IPv4 and IPv6 hints in their browser.

`/example.com/` <http://example.com/%60>  blocks everything with NXDOMAIN, so it is ideal for me to block all three: A, AAAA, and HTTPS. However, dnsmasq not providing an SOA/negative TTL to the client is somewhat of an issue.

So, please let me know if there are any plans to implement this kind of fake SOA/negative TTL support in dnsmasq.

Sorry for making the mistake in my initial email.

Thanks,

Indronil.

 

On Thu, Sep 17, 2026 at 3:19 PM Indronil Anik <indronilanik at gmail.com <mailto:indronilanik at gmail.com> > wrote:

Hello everyone,

 

I have a question about locally generated NXDOMAIN responses in dnsmasq.

 

I came across this older discussion from 2018:

 

https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2018q1/012042.html

 

The answer mentioned that providing TTL information for locally generated NXDOMAIN responses would require dnsmasq to include an SOA record.

 

It's been 8 years since that email, and I was wondering if anything has changed since then?

 

For example, currently with a blocking rule like:

 

/example.com/# <http://example.com/> 

 

dnsmasq returns NXDOMAIN, but there is no SOA record or negative TTL in the response. Because of that, the client doesn't have anything to use for negative caching, and some stubborn clients or apps keep querying dnsmasq again and again for the same domain, which fills the log with a lot of clutter.

 

Would you please consider adding SOA records with TTL as a feature?

 

For context, I'm using dnsmasq-full on OpenWrt in my router.

 

Thanks,

 

Indronil.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/attachments/20260917/fa6d4265/attachment.htm>