How do I prevent dnsmasq from appending my domain name to invalid domain requests?

Question

I use dnsmasq to resolve DNS queries on my home network. Unfortunately, if a domain name is not known, it will append my own domain name to the request which means that I always end up viewing my own site in a browser.

For example, if I enter http://dlksfhoiahdsfiuhsdf.com in a browser, I end up viewing my own site with that URL. If I try something like:

host dlksfhoiahdsfiuhsdf.com

Instead of the expected:

Host dlksfhoiahdsfiuhsdf.com not found: 3(NXDOMAIN)

I get this:

dlksfhoiahdsfiuhsdf.com.mydomainname.com has address W.X.Y.Z.

Clearly, dnsmasq is appending my domain name to impossible name requests in an effort to resolve them, but I'd rather see the not found error instead.

I've tried playing with the expand-hosts and domain configuration settings, but to no avail. Is there anything else I can try?

Answer 1

I tried removing domain-needed from my own configuration to replicate your issue and it did not produce this behavior. It's the only other parameter I could find that might be close to relevant.

What does your hosts file look like? Maybe something weird is going on there that makes it think all weird domains are local to your network?

Answer 2

try querying with a trailing dot to explicitly set the root:

host dlksfhoiahdsfiuhsdf.com.

Answer 3

It is probably not dnsmasq doing it, but your local resolver library. If you use a unixish, try removing the "search" or "domain" lines from /etc/resolv.conf

Answer 4

There might be other causes, but the most obvious cause is the configuration of /etc/resolv.conf, and the fact that most DNS clients like to be very terse about errors.

benc$ host thing.one
Host thing.one not found: 3(NXDOMAIN)

(okay, what was I using for a DNS config?)

benc$ cat /etc/resolv.conf 
nameserver 192.168.1.1

(edit...)

benc$ cat /etc/resolv.conf 
search test.com
nameserver 192.168.1.1
benc$ host thing.one
thing.one.test.com has address 64.214.163.132

Without bothering to do a packet trace, the likely behavior is that it returns the error for the last FQDN it tried.