Ubuntu Server 16.04.04


listen-address =,, 
resolv-file = /etc/resolv.dnsmasq


nameserver =


# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)

ps aux | grep dns

dnsmasq  13099  0.0  0.0  52864   400 ?        S    17:16   0:00 /usr/sbin/dnsmasq -x /var/run/dnsmasq/dnsmasq.pid -u dnsmasq -7 /etc/dnsmasq.d,.dpkg-dist,.dpkg-old,.dpkg-new --local-service --trust-anchor=.,19036,8,2,49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5

Local Firewall ist turned off:

sudo ufw status
Status: inactive

dig cisco.com

; <<>> DiG 9.10.3-P4-Ubuntu <<>> cisco.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 51709
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;cisco.com.         IN  A

;; Query time: 0 msec
;; WHEN: Sun Apr 15 17:26:05 CEST 2018
;; MSG SIZE  rcvd: 27

to this dig corresponding entry in syslog:

dnsmasq[13099]: query[A] cisco.com from

I just don't get why I always get a REFUSED.


  • 1
    Are the rest of your network settings correct? Last time I had this, it was a wrong gateway that prevented outbound connections, and dnsmasq just was where I noticed it. – Ulrich Schwarz Apr 15 '18 at 16:13
  • indeed, it was this problem. For whatever reason dnsmasq used the wroing gateway. thanks – f0rd42 Apr 16 '18 at 9:04
  • @f0rd42 how did you correct the wrong gateway? – Daniel Sokolowski Apr 3 '19 at 6:53

This fixed for me:

In my dnsmasq.conf file, I did not have a server= directive in the file. I had to add this with my upstream ISP DNS server ip, restarted dnsmasq and it worked fine.


The reason this fails is because the entry for /etc/resolv.dnsmasq is invalid. It must not contain an equals symbol (=).

1. Incorrect

echo 'nameserver =' >/etc/resolv.dnsmasq
systemctl restart dnsmasq
dig @localhost bbc.co.uk | grep -Ew 'status|A'
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 29172
;bbc.co.uk.                     IN      A

2. Correct

echo 'nameserver' >/etc/resolv.dnsmasq
systemctl restart dnsmasq
dig @localhost bbc.co.uk | grep -Ew 'status|A'
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52524
;bbc.co.uk.                     IN      A
bbc.co.uk.              95      IN      A
bbc.co.uk.              95      IN      A
bbc.co.uk.              95      IN      A
bbc.co.uk.              95      IN      A

As to a reason for this working on earlier versions of Ubuntu and Debian (Stretch) but failing on more recent ones such as Debian (Buster)? I don't know; perhaps the syntax was tightened up so that it had to be correct.


Same problem here. Resolved by disabling ipv6.

  • How did you disable IPv6, I'm having the same problem on OpenWrt and am unable to figure it out. – Daniel Sokolowski Apr 3 '19 at 6:54

My answer to these problems, that works for me, it is:

chmod 755 /

that solves all my problems, that I describe, to my delete comment. the permissions of my root / directory was, 0700, and in my guess that prevents the user that dnsmasq change its process to, to act correctly.

Another good idea is to find out the if the permissions in dnsmasq's user home directory is the right ones. In my system dnsmasq is that user, so that command:

cat /etc/passwd | grep dnsmasq

it's going to show me the home dir of that user, (in my case /var/lib/misc)

PS: I make some comments yesterday (but like post, cause my reputation isn't enough), about the fact, that 2 members in this thread, that declare they solved the problem, ignore the request 'How you resolve, your problem ?' by other users, but that deleted by the admins, so I'm not going to repeat.

  • If / had permissions of 0700 then something had broken it. The permissions must be 0755 otherwise the OS cannot operate – roaima Apr 1 '20 at 12:05
  • As you might know the OS in linux systems, run under the 'root' user. So even if the permission of / is 000, the OS can operate. – kapad Apr 10 '20 at 1:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.