Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use dnsmasq as a whitelist on my network. My dnsmasq.conf file looks like this:



I would like to be able to block a subdomain, for example:


I also tried:


And for both I tried substituting for

Unfortunately this doesn't seem to work. How can I block a specific subdomain while allowing the rest of the domain in the config file?

share|improve this question

migrated from serverfault.com May 23 '14 at 1:30

This question came from our site for system and network administrators.

Please do not hijack the DNS. This interferes with the low-level architecture of the Internet. There are nearly no ethical applications of DNS hijacking that would not be better served by a firewall appliance or program.

If you want to prevent the resolution of a zone to an address, you can easily edit the client hosts file.

While dnsmasq is capable of serving the type of 'spoofed' DNS results you describe, the dnsmasq server can easily be circumvented by an end-user or malicious attacker accessing the client host. This type of DNS hijacking is therefore nearly incapable of providing any benefit to security.

Again, a properly configured firewall appliance would likely serve you much better if the goal is blocking clients from accessing malicious or untrusted remote hosts unintentionally. A trendy solution is OpenWRT on a Rasperry Pi, as described in this article.

share|improve this answer
+1 for L7 filtering with netfilter – Marcel May 28 '14 at 16:51
Editing clients' host files in this case is not possible/practical. How could the server be circumvented by an end user or a malicious attacker? As for using iptables/netfilter, I've looked into that in the past and the problem has always been using domain names in firewall rules - which are resolved at start up and subject to change. I do have an iptables rule to drop DNS queries though. – Dave Kennedy May 29 '14 at 23:27
It is unfortunate that this received the bounty automatically, even though it didn't answer the question. – Dave Kennedy Jun 2 '14 at 19:05

With dnsmasq this works actually :


Did you restart dnsmasq after the change ?

For details on setting up dnsmasq see this one.

Note: As others pointed out for this you could just use /etc/hosts    meta.stackexchange.com
share|improve this answer

You can block a website with host record:


or a cname:


But really both of these are pretty ineffective ways to block a website. I could go to my /etc/hosts file and fix the issue.

share|improve this answer
"I could go to my /etc/hosts file and fix the issue." You'd have to get the IP address first, which you wouldn't be able to on this network. – Dave Kennedy May 29 '14 at 15:14
not quite... nslookup meta.stackexchange.com will bypass your default DNS server. – Jonathan S. Fisher May 29 '14 at 18:49
Ah, I forgot to mention. I have an iptables rule to drop DNS queries. – Dave Kennedy May 29 '14 at 23:26
Neither of these work. cname because There are significant limitations on the target; it must be a DNS name which is known to dnsmasq from /etc/hosts (or additional hosts files), from DHCP, from --interface-name or from another --cname. If the target does not satisfy this criteria, the whole cname is ignored. (man) I'm not sure why host-record doesn't work. – Dave Kennedy May 30 '14 at 1:16
host-record works for me... strange. – Jonathan S. Fisher May 30 '14 at 14:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.