Never forward these matching domains or subdomains; resolve from DHCP or hosts files only.

Local domain suffix appended to DHCP names and hosts file entries.

Add local domain suffix to names served from hosts files.

Resolve specified FQDNs to an IP.
Syntax: /fqdn[/fqdn…]/[ipaddr].
/example.com/ returns NXDOMAIN.
/#/ matches any domain (and returns NXDOMAIN).
/example.com/# returns NULL addresses (0.0.0.0, ::) for example.com and its subdomains.

Query all available upstream resolvers. First answer wins.

By default, dnsmasq caches A, AAAA, CNAME and SRV DNS record types.
This option adds additional record types to the cache.

Bind only to configured interface addresses, instead of the wildcard address.

Listen only on the specified interfaces, and loopback if not excluded explicitly.

Listen only on the specified addresses.

Do not listen on the specified interfaces.

Listening port for inbound DNS queries.

Fixed source port for outbound DNS queries.

Min valid value 1024. Useful for systems behind firewalls.

Max valid value 65535. Useful for systems behind firewalls.

Never forward DNS queries which lack dots or domain parts.
Names not in /etc/hosts are answered Not found.

Discard upstream responses containing RFC1918 addresses.
Discard also upstream responses containing RFC4193, Link-Local and private IPv4-Mapped RFC4291 IPv6 Addresses.

Exempt 127.0.0.0/8 and ::1 from rebinding checks, e.g. for RBL services.

List of domains to allow RFC1918 responses for.

Accept DNS queries only from hosts whose address is on a local subnet.

Reject reverse lookups to RFC6303 IP ranges (*.IN-ADDR.ARPA,*.IP6.ARPA) not in /etc/hosts.

Filters SRV/SOA service discovery, to avoid triggering dial-on-demand links.
May prevent VoIP or other services from working.

Remove IPv6 addresses from the results and only return IPv4 addresses.
Can be useful if ISP has IPv6 nameservers but does not provide IPv6 routing.

Remove IPv4 addresses from the results and only return IPv6 addresses.

Removes records of the specified type(s) from answers.

Limit response records (from /etc/hosts) to those that fall within the subnet of the querying interface.
This prevents unreachable IPs in subnets not accessible to you.
Note: IPv4 only.

Do not cache negative replies, e.g. for non-existent domains.

Transform replies which contain the specified addresses or subnets into NXDOMAIN responses.

Forward specific domain queries to specific upstream servers.

File listing upstream resolvers, optionally domain-specific, e.g. server=1.2.3.4, server=/domain/1.2.3.4.

Add the MAC address of the requestor to DNS queries which are forwarded upstream.
enabled uses the default MAC address format encoding
base64 uses an alternative encoding of the MAC as base64
text uses a human-readable encoding of hex-and-colons

Remove any MAC address information already in downstream queries before forwarding upstream.

Add a subnet address to the DNS queries which are forwarded upstream, leaving this value empty disables the feature. If an address is specified in the flag, it will be used, otherwise, the address of the requestor will be used. The amount of the address forwarded depends on the prefix length parameter: 32 (128 for IPv6) forwards the whole address, zero forwards none of it but still marks the request so that no upstream nameserver will add client address information either.
The default (0,0) is zero for both IPv4 and IPv6.
24,96 adds the /24 and /96 subnets of the requestor for IPv4 and IPv6 requestors, respectively.
1.2.3.4/24 adds 1.2.3.0/24 for IPv4 requestors and ::/0 for IPv6 requestors.
1.2.3.4/24,1.2.3.4/24 adds 1.2.3.0/24 for both IPv4 and IPv6 requestors.

Remove any subnet address already present in a downstream query before forwarding it upstream.

Maximum allowed size of EDNS0 UDP packets.

Maximum allowed number of concurrent DNS queries.

Number of cached DNS entries, 10000 is maximum, 0 is no caching.

Extend short TTL values to the seconds value given when caching them. Use with caution. (Max 1h == 3600)

Set a maximum seconds TTL value for entries in the cache.

Write received DNS queries to syslog. Dump cache on SIGUSR1, include requesting IP.

Set log class/facility for syslog entries.

File with upstream resolvers.

Query upstream resolvers in the order they appear in the resolv file.

On: use instance specific hosts file only
Off: use all files in the directory including the instance specific hosts file