I think defining a local CNAME for e.g. nxdomain.example.com with just a dot should be close to what you want to achieve. Did this on my pi-hole just now. Or what am I missing?
Regards, Joachim Von: Dnsmasq-discuss <[email protected]> Im Auftrag von Indronil Anik Gesendet: Donnerstag, 17. September 2026 13:13 An: [email protected] Betreff: Re: [Dnsmasq-discuss] NXDOMAIN responses and negative TTL/SOA Small correction to my example in the previous email: I mistakenly used `/example.com/#` <http://example.com/#`> as the example. That returns a null IP address, not NXDOMAIN. What I actually meant was a blocking rule like: /example.com/ <http://example.com/> in the dnsmasq Forward section, which returns NXDOMAIN for all queries. My question is specifically about these locally generated NXDOMAIN responses: since they don't contain an SOA record or negative TTL, the client can't negatively cache the response and may keep querying dnsmasq repeatedly for the same domain. Another thing is that I don't just want to block A and AAAA queries. Nowadays, HTTPS records are also used, and for some domains they can contain IPv4 and IPv6 address hints. If HTTPS records for blocked domains are not blocked, some clients may use the IPs received from those hints and still successfully connect to those domains. The Chrome team has also said they have plans to add support for IPv4 and IPv6 hints in their browser. `/example.com/` <http://example.com/%60> blocks everything with NXDOMAIN, so it is ideal for me to block all three: A, AAAA, and HTTPS. However, dnsmasq not providing an SOA/negative TTL to the client is somewhat of an issue. So, please let me know if there are any plans to implement this kind of fake SOA/negative TTL support in dnsmasq. Sorry for making the mistake in my initial email. Thanks, Indronil. On Thu, Sep 17, 2026 at 3:19 PM Indronil Anik <[email protected] <mailto:[email protected]> > wrote: Hello everyone, I have a question about locally generated NXDOMAIN responses in dnsmasq. I came across this older discussion from 2018: https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2018q1/012042.html The answer mentioned that providing TTL information for locally generated NXDOMAIN responses would require dnsmasq to include an SOA record. It's been 8 years since that email, and I was wondering if anything has changed since then? For example, currently with a blocking rule like: /example.com/# <http://example.com/> dnsmasq returns NXDOMAIN, but there is no SOA record or negative TTL in the response. Because of that, the client doesn't have anything to use for negative caching, and some stubborn clients or apps keep querying dnsmasq again and again for the same domain, which fills the log with a lot of clutter. Would you please consider adding SOA records with TTL as a feature? For context, I'm using dnsmasq-full on OpenWrt in my router. Thanks, Indronil.
_______________________________________________ Dnsmasq-discuss mailing list [email protected] https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss
