How can I make my primary DNS take priority over other servers?

Question

Note - I believe my title is the way it's meant to be...

I used dnsmasq on my server and it sets DNS (via DHCP) to clients as:

192.168.2.1 (local server)
ISP DNS 1
ISP DNS 2

This at least works - in my Ubuntu client sudo nmcli dev list | grep DNS gives

IP4.DNS[1]:                             192.168.2.1 (local)
IP4.DNS[2]:                             122.56.237.1 (ISP 1)
IP4.DNS[3]:                             210.55.111.1 (ISP 2)

However, if I execute ping mail.mydomain.org it returns the external internet address instead of the local network.

nslookup shows that Ubuntu's network manager is at work (matching nmcli above), and states the external IP for my domain is Non-Authoritative. When I change to server 192.168.2.1, the search just gives me the local IP.

My (client's) resolve.conf ends up with

nameserver 172.20.1.153
nameserver 172.20.1.6
nameserver 127.0.1.1

Is the primary at the bottom? It's what nslookup seems to use...

So how can this happen? What should I do to fix it? (I certainly want to keep a secondary DNS). I've tried just having the local DNS server, but dnsmasq can't seem to forward anything no matter what config I change (the documentation isn't helpful either, since it seems that it should "just forward" by default).

And note that while my analysis is on Ubuntu, the same is happening on a Mac too.

Answer 1

Neither DNS resolver lists nor NS record sets are intrinsically ordered, so there is no "primary". Clients are free to query whichever one they want in whichever order they want. For resolvers specifically, clients might default to using the servers in the same order as they were given to the client, but, as you've discovered, they also might not.

Answer 2

The easiest way to do this, IMO, is to have your local resolver also do recursive lookups. You configure your local resolver with the IPs of your ISPs' resolvers, and then configure all your clients with only the local one. It'll respond with its own information if it has it, and the timing penalty for going via a server on the LAN is insignificant.