Dnsmasq — Lightweight DNS Forwarder and DHCP Server

Dnsmasq is a lightweight network services daemon that provides DNS forwarding, DHCP server, router advertisement, and network boot capabilities. Designed for small networks, it runs on Linux, BSD, and Android. It is the DNS engine inside many home routers, including DD-WRT, OpenWrt, and Tomato firmware.

What makes Dnsmasq special is its simplicity. The configuration file is a few lines long. The resource usage is minimal. It can run on a router with 16MB of RAM and still serve a network of dozens of devices. If you need a DNS server for your home or small office network, Dnsmasq is the best place to start.

DNS Forwarding

Dnsmasq's primary function is DNS forwarding. It receives DNS queries from devices on your network, forwards them to upstream DNS resolvers, caches the responses, and returns them to the requesting devices. The caching significantly speeds up repeat queries.

Configure the upstream DNS servers with the server directive. You can specify multiple servers: server=1.1.1.1 and server=8.8.8.8. Dnsmasq sends queries to these servers in parallel and uses the first response. This provides automatic failover if one server is slow or unreachable.

Dnsmasq also supports per-domain forwarding. You can route queries for specific domains to different DNS servers. This is useful for split DNS setups where internal domains should be resolved by an internal DNS server and external domains by a public resolver.

Increase the default cache size for better performance. The default cache holds 150 entries. Set cache-size=10000 in the configuration. With a large cache, Dnsmasq can answer most queries from memory without contacting the upstream server.

DHCP Server

Dnsmasq includes a full DHCP server. It can assign IP addresses to devices on your network, configure DNS servers, set default gateways, and provide network boot options. The DHCP server is tightly integrated with the DNS forwarder, so devices get automatic DNS resolution of local hostnames.

Enable DHCP with the dhcp-range directive: dhcp-range=192.168.1.100,192.168.1.200,12h. This assigns addresses from 192.168.1.100 to 192.168.1.200 with a 12-hour lease time. Dnsmasq automatically adds DNS entries for each leased address, so you can reach devices on your network by hostname.

Static DHCP assignments let you assign fixed IP addresses to specific devices based on their MAC address. This is useful for servers, printers, and other devices that need consistent IP addresses. Use the dhcp-host directive: dhcp-host=00:11:22:33:44:55,192.168.1.10.

Local Domain Resolution

One of Dnsmasq's most useful features is local domain resolution. It automatically registers the hostnames of devices that receive DHCP leases. If a laptop gets the name bob-laptop from its DHCP lease, Dnsmasq resolves bob-laptop.lan to its IP address. No manual DNS configuration needed.

Set the local domain with the domain directive: domain=lan. Dnsmasq creates A records for all DHCP clients under this domain. You can reach any device by its hostname plus the domain suffix. This is much easier than remembering IP addresses.

Dnsmasq also supports address aliases with the cname directive. You can create friendly names for services: cname=nas.lan,192.168.1.10 or point a CNAME to another hostname registered by DHCP. This makes it easy to set up memorable names for your network services.

Common Configuration Examples

Basic DNS forwarder with caching: set server to Cloudflare and Google, set cache-size to 10000, enable dnssec. This configuration turns any Linux box into a fast, caching DNS server for your network.

DNS with DHCP: add dhcp-range and dhcp-option directives. Dnsmasq assigns IP addresses and tells devices to use itself as the DNS server. This is the configuration used by most home routers.

Pi-hole with Dnsmasq: Pi-hole uses a modified version of Dnsmasq as its DNS forwarder. The Pi-hole interface configures Dnsmasq's blocking, caching, and forwarding features. You can manually edit the Dnsmasq configuration files for advanced settings.

Dnsmasq with Stubby for encrypted DNS: configure Dnsmasq to forward queries to Stubby running on 127.0.0.1:53. Stubby encrypts the queries using DNS over TLS. This gives you caching from Dnsmasq and encryption from Stubby in a two-service setup.

Advanced Dnsmasq Configuration

Dnsmasq supports DNSSEC validation. Enable it with dnssec and set a trust anchor. Dnsmasq will validate DNSSEC signatures on all responses. If validation fails, the query returns SERVFAIL. This protects your network from DNS spoofing attacks.

Access control restricts which devices can use Dnsmasq. The except-interface and listen-address directives control which network interfaces Dnsmasq listens on. The bogus-priv directive drops reverse DNS lookups for private IP ranges, preventing information leakage.

Dnsmasq can also block domains using the address directive with a specific IP or using server with a blackhole domain. For full network ad blocking, Pi-hole or AdGuard Home provide a better user interface. But for simple blocking of a few domains, Dnsmasq's built-in features suffice.

For more on setting up Dnsmasq from scratch, see our DNS server setup guide.