I've tried to have dnsmasq (version 2.66) listen only to the loopback interface but it obsesses on listening to all available addresses, i.e. despite the following arguments:

# dnsmasq -ilo --pid-file=/run/dnsmasq-lo.pid

dnsmasq: failed to create listening socket for port 53: Adress already in use

I have other running dnsmasq processes and they seem to listen only to one IP address:

# netstat -ltaupn | sed -rne 2p -e '/:53\b/p'
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0*               LISTEN      4224/dnsmasq    
tcp        0      0*               LISTEN      4221/dnsmasq    
udp        0      0*                           4224/dnsmasq    
udp        0      0*                           4221/dnsmasq    

When I kill all dnsmasq instances and re-run my command, here's what I have:

# dnsmasq -ilo --pid-file=/run/dnsmasq-lo.pid
# netstat -ltaupn | sed -rne 2p -e '/:53\b/p'
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0    *               LISTEN      4452/dnsmasq    
tcp6       0      0 :::53                   :::*                    LISTEN      4452/dnsmasq    
udp        0      0    *                           4452/dnsmasq    
udp6       0      0 :::53                   :::*                                4452/dnsmasq    

The following arguments, alone or combined don't change a darn thing:

-Ieth0 -Ieth1 -Ivirbr0 -Ivrbr1

How can I force dnsmasq to listen only the one interface I want, i.e. the loopback interface?

  • 1
    Add --bind-interfaces Commented Aug 10, 2015 at 9:24
  • 1
    Wut? Wait, it worked... But the help is absolutely misleading: «Bind only to interfaces in use» plural form! I discarded that parameter on purpose because I didn't want to bind to [all] the interfaces in use, just one and only one. Thanks a lot for your hint anyway. I overlooked dnsmasq-base being installed, it's a limited version of dnsmasq so I tried using only a configuration file... it worked too, even without the bind-interfaces clause!
    – user86969
    Commented Aug 10, 2015 at 9:34
  • 1
    The man page is pretty clear about it. And it is interfaces plural as you can do --bind-interface -i lo -i br1... to bind on the addresses on lo and br1. See also --bind-dynamic. Commented Aug 10, 2015 at 10:13
  • I get it. I should have read the man page as dnsmasq --help | grep bind-interfaces is misleading: «Bind only to interfaces in use» Reading that one did not ring the RTFMP bell. Thanks for clarifying.
    – user86969
    Commented Aug 10, 2015 at 12:57
  • please feel free to answer your question with that info. Commented Aug 10, 2015 at 12:59

1 Answer 1


Thanks to stéphane-chazelas, one possible answer is to add --bind-interfaces. I overlooked that option from limiting myself to reading the command line help:

# dnsmasq --help | grep bind-interfaces
-z, --bind-interfaces                   Bind only to interfaces in use.

I didn't have the reflex to double check with the man page. That help still is confusing, IMHO.

The man page however states:

   -z, --bind-interfaces
          On systems which support it, dnsmasq binds the wildcard address,
          even when it is listening on only some interfaces. It then  dis-
          cards  requests  that it shouldn't reply to. This has the advan-
          tage of working even when interfaces  come  and  go  and  change
          address.  This  option  forces  dnsmasq  to really bind only the
          interfaces it is listening on. About the only time when this  is
          useful  is  when running another nameserver (or another instance
          of dnsmasq) on  the  same  machine.  Setting  this  option  also
          enables multiple instances of dnsmasq which provide DHCP service
          to run in the same machine.

which is clearer.

  • Unfortunately bind-interfaces doesn't appear to work with interface=eth1 for example, instead exiting with unknown interface eth1. Commented Dec 12, 2023 at 14:58

You must log in to answer this question.