I'm trying to set a couple of DNS servers to resolve only specified domains. My first attempt was to run DNSmasq and create a manual list of domains/IPs, like so:


But big services like google, twitter, whatsapp, facebook, etc.. use several IP ranges and distribute them in different ways (subdomains, protocols, geolocation, device type of the client, etc.), and this is causing some troubles.

I think the simplest approach would be to say something like:

Forward DNS queries of these domains to resolv.conf and block anything else

Is there a way to do it?


You're looking for the server= directive instead of the address= directive. Unfortunately, you'll have to specify your actual DNS servers, it won't get them from resolv.conf (since you are using no-resolv to prevent that).


You probably want to generate that with a script. And of course you can use your normal DNS servers instead of Google Public DNS.

Alternatively, you can use BIND (though note that there are other configs if your goal isn't filtering).

  • It looks like BIND doesn't do whitelisting, only blacklisting.
    – Rob
    Jul 7 '15 at 16:49
  • server= directive needs the server always, if server is not specified it will only look into hosts to find address, it won't try to query other DNS
    – mencargo
    Apr 5 '17 at 2:45
  • The server=/.... lines — one adds them to /etc/dnsmasq.conf? (that's the right file, on Debian?)
    – KajMagnus
    May 21 '20 at 6:41
  • 1
    @KajMagnus yeah, or a file in the .d directory if you have that.
    – derobert
    May 21 '20 at 19:03
  • @derobert Thanks — this looks simpler than installing Pi-hole.
    – KajMagnus
    May 21 '20 at 21:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.