There's a reason it's done this way.

Unless you do the upstream query, you can't, in general, know if the answer should be NODATA or NXDOMAIN.

Guessing wrong NXDOMAIN is really bad; you'll lose answers for other RRtypes.

Guessing wrong NODATA isn't so bad, you might make unnecessary queries for other RRtypes. It's also lying to downstream, and that might come back to bite you in unexpected ways.

Cheers,

Simon.


On 27.02.2026 02:44, [email protected] wrote:

I'm using the following configuration with dnsmasq to drop specific
types of DNS requests:

filter-rr=NS,MX,TXT,HTTPS,PTR

However, I have noticed that dnsmasq still sends these requests to the
upstream DNS server before filtering them out.
For example:

dnsmasq[830633]: query[TXT] nsa.gov from 127.0.0.1
dnsmasq[830633]: forwarded nsa.gov to 127.0.0.1#5353 <--
dnsmasq[830633]: config nsa.gov is NODATA
dnsmasq[830633]: config nsa.gov is NODATA
dnsmasq[830633]: query[HTTPS] nsa.gov from 127.0.0.1
dnsmasq[830633]: forwarded nsa.gov to 127.0.0.1#5353 <--
dnsmasq[830633]: reply nsa.gov is NODATA


The lines that state "forwarded" indicate that dnsmasq is querying the
upstream DNS server despite already knowing that the answer will
ultimately be dropped.
This behavior contradicts your documentation, which states: "Remove
records of the specified type(s) from answers."

Thus my Proposal:

If the query type is already listed in `filter-rr`, I suggest that
dnsmasq should do:
- Drop the request immediately without forwarding.
- Provide an immediate response stating like "config nsa.gov is NODATA."

This change would enhance efficiency by eliminating unnecessary queries
to the upstream server
as well as preventing unnecessary leaks to adversary.

Thank you for considering this suggestion.

_______________________________________________
Dnsmasq-discuss mailing list
[email protected]
https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss

_______________________________________________
Dnsmasq-discuss mailing list
[email protected]
https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss