Usage: dnsmasq [options]
Valid options are:
-a, --listen-address=<ipaddr> Specify local address(es) to listen on.
-A, --address=/<domain>/<ipaddr> Return ipaddr for all hosts in specified domains.
-b, --bogus-priv Fake reverse lookups for RFC1918 private address ranges.
-B, --bogus-nxdomain=<ipaddr> Treat ipaddr as NXDOMAIN (defeats Verisign wildcard).
-c, --cache-size=<integer> Specify the size of the cache in entries (defaults to 150).
-C, --conf-file=<path> Specify configuration file (defaults to /etc/dnsmasq.conf).
-d, --no-daemon Do NOT fork into the background: run in debug mode.
-D, --domain-needed Do NOT forward queries with no domain part.
-e, --selfmx Return self-pointing MX records for local hosts.
-E, --expand-hosts Expand simple names in /etc/hosts with domain-suffix.
-f, --filterwin2k Don't forward spurious DNS requests from Windows hosts.
--filter-A Don't include IPv4 addresses in DNS answers.
--filter-AAAA Don't include IPv6 addresses in DNS answers.
--filter-rr=<RR-type> Don't include resource records of the given type in DNS answers.
-F, --dhcp-range=<ipaddr>,... Enable DHCP in the range given with lease duration.
-g, --group=<groupname> Change to this group after startup (defaults to nonroot).
-G, --dhcp-host=<hostspec> Set address or hostname for a specified machine.
--dhcp-hostsfile=<path> Read DHCP host specs from file.
--dhcp-optsfile=<path> Read DHCP option specs from file.
--dhcp-hostsdir=<path> Read DHCP host specs from a directory.
--dhcp-optsdir=<path> Read DHCP options from a directory.
--tag-if=tag-expression Evaluate conditional tag expression.
-h, --no-hosts Do NOT load /etc/hosts file.
-H, --addn-hosts=<path> Specify a hosts file to be read in addition to /etc/hosts.
--hostsdir=<path> Read hosts files from a directory.
-i, --interface=<interface> Specify interface(s) to listen on.
-I, --except-interface=<interface> Specify interface(s) NOT to listen on.
-j, --dhcp-userclass=set:<tag>,<class> Map DHCP user class to tag.
--dhcp-circuitid=set:<tag>,<circuit> Map RFC3046 circuit-id to tag.
--dhcp-remoteid=set:<tag>,<remote> Map RFC3046 remote-id to tag.
--dhcp-subscrid=set:<tag>,<remote> Map RFC3993 subscriber-id to tag.
--dhcp-pxe-vendor=<vendor>[,...] Specify vendor class to match for PXE requests.
-J, --dhcp-ignore=tag:<tag>... Don't do DHCP for hosts with tag set.
--dhcp-broadcast[=tag:<tag>...] Force broadcast replies for hosts with tag set.
-k, --keep-in-foreground Do NOT fork into the background, do NOT run in debug mode.
-K, --dhcp-authoritative Assume we are the only DHCP server on the local network.
-l, --dhcp-leasefile=<path> Specify where to store DHCP leases (defaults to /var/lib/misc/dnsmasq.leases).
-L, --localmx Return MX records for local hosts.
-m, --mx-host=<host_name>,<target>,<pref> Specify an MX record.
-M, --dhcp-boot=<bootp opts> Specify BOOTP options to DHCP server.
-n, --no-poll Do NOT poll /etc/resolv.conf file, reload only on SIGHUP.
-N, --no-negcache Do NOT cache failed search results.
--use-stale-cache[=<max_expired>] Use expired cache data for faster reply.
-o, --strict-order Use nameservers strictly in the order given in /etc/resolv.conf.
-O, --dhcp-option=<optspec> Specify options to be sent to DHCP clients.
--dhcp-option-force=<optspec> DHCP option sent even if the client does not request it.
--dhcp-option-pxe=<optspec> DHCP option sent only to PXE clients.
-p, --port=<integer> Specify port to listen for DNS requests on (defaults to 53).
-P, --edns-packet-max=<integer> Maximum supported UDP packet size for EDNS.0 (defaults to 1232).
-q, --log-queries Log DNS queries.
-Q, --query-port=<integer> Force the originating port for upstream DNS queries.
--port-limit=#ports Set maximum number of random originating ports for a query.
-R, --no-resolv Do NOT read resolv.conf.
-r, --resolv-file=<path> Specify path to resolv.conf (defaults to /etc/resolv.conf).
--servers-file=<path> Specify path to file with server= options
-S, --server=/<domain>/<ipaddr> Specify address(es) of upstream servers with optional domains.
--rev-server=<addr>/<prefix>,<ipaddr> Specify address of upstream servers for reverse address queries
--local=/<domain>/ Never forward queries to specified domains.
-s, --domain=<domain>[,<range>] Specify the domain to be assigned in DHCP leases.
-t, --mx-target=<host_name> Specify default target in an MX record.
-T, --local-ttl=<integer> Specify time-to-live in seconds for replies from /etc/hosts.
--neg-ttl=<integer> Specify time-to-live in seconds for negative caching.
--max-ttl=<integer> Specify time-to-live in seconds for maximum TTL to send to clients.
--max-cache-ttl=<integer> Specify time-to-live ceiling for cache.
--min-cache-ttl=<integer> Specify time-to-live floor for cache.
--fast-dns-retry=<milliseconds> Retry DNS queries after this many milliseconds.
-u, --user=<username> Change to this user after startup. (defaults to nonroot).
-U, --dhcp-vendorclass=set:<tag>,<class> Map DHCP vendor class to tag.
-v, --version Display dnsmasq version and copyright information.
-V, --alias=<ipaddr>,<ipaddr>,<netmask> Translate IPv4 addresses from upstream servers.
-W, --srv-host=<name>,<target>,... Specify a SRV record.
-w, --help Display this message. Use --help dhcp or --help dhcp6 for known DHCP options.
-x, --pid-file=<path> Specify path of PID file (defaults to /run/dnsmasq.pid).
-X, --dhcp-lease-max=<integer> Specify maximum number of DHCP leases (defaults to 1000).
-y, --localise-queries Answer DNS queries based on the interface a query was sent to.
-Y, --txt-record=<name>,<txt>[,<txt] Specify TXT DNS record.
--ptr-record=<name>,<target> Specify PTR DNS record.
--interface-name=<name>,<interface> Give DNS name to IPv4 address of interface.
-z, --bind-interfaces Bind only to interfaces in use.
-Z, --read-ethers Read DHCP static host information from /etc/ethers.
-1, --enable-dbus[=<busname>] Enable the DBus interface for setting upstream servers, etc.
--enable-ubus[=<busname>] Enable the UBus interface.
-2, --no-dhcp-interface=<interface> Do not provide DHCP on this interface, only provide DNS.
--no-dhcpv6-interface=<interface> Do not provide DHCPv6 on this interface.
--no-dhcpv4-interface=<interface> Do not provide DHCPv4 on this interface.
-3, --bootp-dynamic[=tag:<tag>]... Enable dynamic address allocation for bootp.
-4, --dhcp-mac=set:<tag>,<mac address> Map MAC address (with wildcards) to option set.
--bridge-interface=<iface>,<alias>.. Treat DHCP requests on aliases as arriving from interface.
--shared-network=<iface>|<addr>,<addr> Specify extra networks sharing a broadcast domain for DHCP
--leasequery[<addr>[/prefix>]] Enable RFC 4388 leasequery functions for DHCPv4
-5, --no-ping Disable ICMP echo address checking in the DHCP server.
-6, --dhcp-script=<path> Shell script to run on DHCP lease creation and destruction.
--dhcp-luascript=path Lua script to run on DHCP lease creation and destruction.
--dhcp-scriptuser=<username> Run lease-change scripts as this user.
--script-arp Call dhcp-script with changes to local ARP table.
-7, --conf-dir=<path> Read configuration from all the files in this directory.
--conf-script=<path> Execute file and read configuration from stdin.
-8, --log-facility=<facility>|<file> Log to this syslog facility or file. (defaults to DAEMON)
-9, --leasefile-ro Do not use leasefile.
-0, --dns-forward-max=<integer> Maximum number of concurrent DNS queries. (defaults to 150)
--clear-on-reload Clear DNS cache when reloading /etc/resolv.conf.
--dhcp-ignore-names[=tag:<tag>]... Ignore hostnames provided by DHCP clients.
--dhcp-no-override Do NOT reuse filename and server fields for extra DHCP options.
--enable-tftp[=<intr>[,<intr>]] Enable integrated read-only TFTP server.
--tftp-root=<dir>[,<iface>] Export files by TFTP only from the specified subtree.
--tftp-unique-root[=ip|mac] Add client IP or hardware address to tftp-root.
--tftp-secure Allow access only to files owned by the user running dnsmasq.
--tftp-no-fail Do not terminate the service if TFTP directories are inaccessible.
--tftp-max=<integer> Maximum number of concurrent TFTP transfers (defaults to 50).
--tftp-mtu=<integer> Maximum MTU to use for TFTP transfers.
--tftp-no-blocksize Disable the TFTP blocksize extension.
--tftp-lowercase Convert TFTP filenames to lowercase
--tftp-port-range=<start>,<end> Ephemeral port range for use by TFTP transfers.
--tftp-single-port Use only one port for TFTP server.
--log-dhcp Extra logging for DHCP.
--log-async[=<integer>] Enable async. logging; optionally set queue length.
--stop-dns-rebind Stop DNS rebinding. Filter private IP ranges when resolving.
--rebind-localhost-ok Allow rebinding of 127.0.0.0/8, for RBL servers.
--rebind-domain-ok=/<domain>/ Inhibit DNS-rebind protection on this domain.
--all-servers Always perform DNS queries to all servers.
--dhcp-match=set:<tag>,<optspec> Set tag if client includes matching option in request.
--dhcp-name-match=set:<tag>,<string>[*] Set tag if client provides given name.
--dhcp-alternate-port[=<ports>] Use alternative ports for DHCP.
--naptr-record=<name>,<naptr> Specify NAPTR DNS record.
--min-port=<port> Specify lowest port available for DNS query transmission.
--max-port=<port> Specify highest port available for DNS query transmission.
--dhcp-fqdn Use only fully qualified domain names for DHCP clients.
--dhcp-generate-names[=tag:<tag>] Generate hostnames based on MAC address for nameless clients.
--dhcp-proxy[=<ipaddr>]... Use these DHCP relays as full proxies.
--dhcp-relay=<local-addr>,<server>[,<iface>] Relay DHCP requests to a remote server
--dhcp-split-relay=<local-addr>,<server>,<iface> Relay DHCP requests to a remote server
--cname=<alias>,<target>[,<ttl>] Specify alias name for LOCAL DNS name.
--pxe-prompt=<prompt>,[<timeout>] Prompt to send to PXE clients.
--pxe-service=<service> Boot service for PXE menu.
--test Check configuration syntax.
--add-mac[=base64|text] Add requestor's MAC address to forwarded DNS queries.
--strip-mac Strip MAC information from queries.
--add-subnet=<v4 pref>[,<v6 pref>] Add specified IP subnet to forwarded DNS queries.
--strip-subnet Strip ECS information from queries.
--add-cpe-id=<text> Add client identification to forwarded DNS queries.
--proxy-dnssec Proxy DNSSEC validation results from upstream nameservers.
--dhcp-sequential-ip Attempt to allocate sequential IP addresses to DHCP clients.
--dhcp-ignore-clid Ignore client identifier option sent by DHCP clients.
--conntrack Copy connection-track mark from queries to upstream connections.
--dhcp-client-update Allow DHCP clients to do their own DDNS updates.
--enable-ra Send router-advertisements for interfaces doing DHCPv6
--dhcp-duid=<enterprise>,<duid> Specify DUID_EN-type DHCPv6 server DUID
--host-record=<name>,<address>[,<ttl>] Specify host (A/AAAA and PTR) records
--dynamic-host=<name>,[<IPv4>][,<IPv6>],<interface-Specify host record in interface subnet
--caa-record=<name>,<flags>,<tag>,<value> Specify certification authority authorization record
--dns-rr=<name>,<RR-number>,[<data>] Specify arbitrary DNS resource record
--bind-dynamic Bind to interfaces in use - check for new interfaces
--auth-server=<NS>,<interface> Export local names to global DNS
--auth-zone=<domain>,[<subnet>...] Domain to export to global DNS
--auth-ttl=<integer> Set TTL for authoritative replies
--auth-soa=<serial>[,...] Set authoritative zone information
--auth-sec-servers=<NS>[,<NS>...] Secondary authoritative nameservers for forward domains
--auth-peer=<ipaddr>[,<ipaddr>...] Peers which are allowed to do zone transfer
--ipset=/<domain>[/<domain>...]/<ipset>... Specify ipsets to which matching domains should be added
--nftset=/<domain>[/<domain>...]/<nftset>... Specify nftables sets to which matching domains should be added
--connmark-allowlist-enable[=<mask>] Enable filtering of DNS queries with connection-track marks.
--connmark-allowlist=<connmark>[/<mask>][,<pattern>Set allowed DNS patterns for a connection-track mark.
--synth-domain=<domain>,<range>,[<prefix>] Specify a domain and address range for synthesised names
--dnssec Activate DNSSEC validation
--trust-anchor=<domain>,[<class>,]... Specify trust anchor key digest.
--dnssec-debug Disable upstream checking for DNSSEC debugging.
--dnssec-check-unsigned Ensure answers without DNSSEC are in unsigned zones.
--dnssec-no-timecheck Don't check DNSSEC signature timestamps until first cache-reload
--dnssec-timestamp=<path> Timestamp file to verify system clock for DNSSEC
--dnssec-limits=<limit>,.. Set resource limits for DNSSEC validation
--ra-param=<iface>,[mtu:<value>|<interface>|off,][<Set MTU, priority, resend-interval and router-lifetime
--quiet-dhcp Do not log routine DHCP.
--quiet-dhcp6 Do not log routine DHCPv6.
--quiet-ra Do not log RA.
--log-debug Log debugging information.
--local-service Accept queries only from directly-connected networks.
--dns-loop-detect Detect and remove DNS forwarding loops.
--ignore-address=<ipaddr> Ignore DNS responses containing ipaddr.
--dhcp-ttl=<ttl> Set TTL in DNS responses with DHCP-derived addresses.
--dhcp-reply-delay=<integer> Delay DHCP replies for at least number of seconds.
--dhcp-rapid-commit Enables DHCPv4 Rapid Commit option.
--dumpfile=<path> Path to debug packet dump file.
--dumpmask=<hex> Mask which packets to dump.
--script-on-renewal Call dhcp-script when lease expiry changes.
--umbrella[=<optspec>] Send Cisco Umbrella identifiers including remote IP.
--quiet-tftp Do not log routine TFTP.
--no-round-robin Suppress round-robin ordering of DNS records.
--no-0x20-encode Suppress DNS bit 0x20 encoding.
--do-0x20-encode Enable DNS bit 0x20 encoding.
--no-ident Do not add CHAOS TXT records.
--cache-rr=<RR-type> Cache this DNS resource record type.
--max-tcp-connections=<integer> Maximum number of concurrent tcp connections.
--log-malloc Log memory allocation for debugging.
Options (190)
| Option | Description | Source |
|---|---|---|
-a, --listen-address ipaddr | Specify local address(es) to listen on. | help + man |
-A, --address /<domain>/<ipaddr | Return ipaddr for all hosts in specified domains. | help |
-b, --bogus-priv | Fake reverse lookups for RFC1918 private address ranges. | help + man |
-B, --bogus-nxdomain ipaddr | Treat ipaddr as NXDOMAIN (defeats Verisign wildcard). | help |
-c, --cache-size integer | Specify the size of the cache in entries (defaults to 150). | help + man |
-C, --conf-file path | Specify configuration file (defaults to /etc/dnsmasq.conf). | help + man |
-d, --no-daemon | Debug mode: don't fork to the background, don't write a pid file, don't change user id, generate a complete cache dump on receipt on SIGUSR1, log to stderr as well as syslog, don't fork new processes… | help + man |
-D, --domain-needed | Tells dnsmasq to never forward A or AAAA queries for plain names, without dots or domain parts, to upstream nameservers. | help + man |
-e, --selfmx | Return an MX record pointing to itself for each local machine. | help + man |
-E, --expand-hosts | Add the domain to simple names (without a period) in /etc/hosts in the same way as for DHCP-derived names. | help + man |
-f, --filterwin2k | Later versions of windows make periodic DNS requests which don't get sensible answers from the public DNS and can cause problems by triggering dial-on-demand links. | help + man |
--filter-A | Don't include IPv4 addresses in DNS answers. | help + man |
--filter-AAAA | Don't include IPv6 addresses in DNS answers. | help + man |
--filter-rr RR-type | Don't include resource records of the given type in DNS answers. | help |
-F, --dhcp-range ipaddr | will look for addresses on eth0 and then create a range from <network>::1 to <network>::400. | help + man |
-g, --group groupname | Change to this group after startup (defaults to nonroot). | help + man |
-G, --dhcp-host hostspec | Set address or hostname for a specified machine. | help |
--dhcp-hostsfile path | Read DHCP host information from the specified file. | help + man |
--dhcp-optsfile path | Read DHCP option information from the specified file. | help + man |
--dhcp-hostsdir path | This is equivalent to --dhcp-hostsfile, except for the following. | help + man |
--dhcp-optsdir path | This is equivalent to --dhcp-optsfile, with the differences noted for --dhcp-hostsdir. | help + man |
--tag-if tag-expression | Evaluate conditional tag expression. | help |
-h, --no-hosts | Don't read the hostnames in /etc/hosts. | help + man |
-H, --addn-hosts path | Specify a hosts file to be read in addition to /etc/hosts. | help + man |
--hostsdir path | Read all the hosts files contained in the directory. | help + man |
-i, --interface interface | Listen only on the specified interface(s). | help + man |
-I, --except-interface interface | Do not listen on the specified interface. | help + man |
-j, --dhcp-userclass set:<tag | Map from a user-class string to a tag (with substring matching, like vendor classes). | help + man |
--dhcp-circuitid set:<tag | Map from RFC3046 relay agent options to tags. | help + man |
--dhcp-remoteid set:<tag | Map RFC3046 remote-id to tag. | help |
--dhcp-subscrid set:<tag | (IPv4 and IPv6) Map from RFC3993 subscriber-id relay agent options to tags. | help + man |
--dhcp-pxe-vendor vendor | will enable dnsmasq to also provide proxy PXE service to those PXE clients with HW-Client in as their identifier. | help + man |
-J, --dhcp-ignore tag:<tag>... | Don't do DHCP for hosts with tag set. | help |
--dhcp-broadcast tag:<tag>... | Force broadcast replies for hosts with tag set. | help |
-k, --keep-in-foreground | Do not go into the background at startup but otherwise run as normal. | help + man |
-K, --dhcp-authoritative | Should be set when dnsmasq is definitely the only DHCP server on a network. | help + man |
-l, --dhcp-leasefile path | Specify where to store DHCP leases (defaults to /var/lib/misc/dnsmasq.leases). | help + man |
-L, --localmx | Return an MX record pointing to the host given by --mx-target (or the machine on which dnsmasq is running) for each local machine. | help + man |
-m, --mx-host host_name | Specify an MX record. | help |
-M, --dhcp-boot bootp | Specify BOOTP options to DHCP server. | help |
-n, --no-poll | Do NOT poll /etc/resolv.conf file, reload only on SIGHUP. | help + man |
-N, --no-negcache | Do NOT cache failed search results. | help + man |
--use-stale-cache max_expired | Use expired cache data for faster reply. | help |
-o, --strict-order | By default, dnsmasq will send queries to any of the upstream servers it knows about and tries to favour servers that are known to be up. | help + man |
-O, --dhcp-option optspec | Specify options to be sent to DHCP clients. | help |
--dhcp-option-force optspec | DHCP option sent even if the client does not request it. | help |
--dhcp-option-pxe optspec | DHCP option sent only to PXE clients. | help |
-p, --port integer | Specify port to listen for DNS requests on (defaults to 53). | help + man |
-P, --edns-packet-max integer | Specify the largest EDNS.0 UDP packet which is supported by the DNS forwarder. | help + man |
-q, --log-queries | Log the results of DNS queries handled by dnsmasq. | help + man |
-Q, --query-port integer | Send outbound DNS queries from, and listen for their replies on, the specific UDP port <query_port> instead of using random ports. | help + man |
--port-limit #ports | By default, when sending a query via random ports to multiple upstream servers or retrying a query dnsmasq will use a single random port for all the tries/retries. | help + man |
-R, --no-resolv | Don't read /etc/resolv.conf. | help + man |
-r, --resolv-file path | Read the IP addresses of the upstream nameservers from <file>, instead of /etc/resolv.conf. | help + man |
--servers-file path | A special case of --conf-file which differs in two respects. | help + man |
-S, --server /<domain>/<ipaddr | Specify address(es) of upstream servers with optional domains. | help |
--rev-server addr>/<prefix | Specify address of upstream servers for reverse address queries | help |
--local /<domain>/ | Never forward queries to specified domains. | help |
-s, --domain domain | Specify the domain to be assigned in DHCP leases. | help |
-t, --mx-target host_name | Specify the default target for the MX record returned by dnsmasq. | help + man |
-T, --local-ttl integer | When replying with information from /etc/hosts or configuration or the DHCP leases file dnsmasq by default sets the time-to-live field to zero, meaning that the requester should not itself cache the… | help + man |
--neg-ttl integer | Negative replies from upstream servers normally contain time-to-live information in SOA records which dnsmasq uses for caching. | help + man |
--max-ttl integer | Specify time-to-live in seconds for maximum TTL to send to clients. | help + man |
--max-cache-ttl integer | Set a maximum TTL value for entries in the cache. | help + man |
--min-cache-ttl integer | Extend short TTL values to the time given when caching them. | help + man |
--fast-dns-retry milliseconds | Retry DNS queries after this many milliseconds. | help |
-u, --user username | Specify the userid to which dnsmasq will change after startup. | help + man |
-U, --dhcp-vendorclass set:<tag | Map DHCP vendor class to tag. | help |
-v, --version | Display dnsmasq version and copyright information. | help + man |
-V, --alias ipaddr | Translate IPv4 addresses from upstream servers. | help |
-W, --srv-host name | Specify a SRV record. | help |
-w, --help | Display all command-line options. | help + man |
-x, --pid-file path | Specify an alternate path for dnsmasq to record its process-id in. | help + man |
-X, --dhcp-lease-max integer | Limits dnsmasq to the specified maximum number of DHCP leases. | help + man |
-y, --localise-queries | Return answers to DNS queries from /etc/hosts and --interface-name and --dynamic-host which depend on the interface over which the query was received. | help + man |
-Y, --txt-record name | Specify TXT DNS record. | help |
--ptr-record name | Specify PTR DNS record. | help |
--interface-name name | Give DNS name to IPv4 address of interface. | help |
-z, --bind-interfaces | On systems which support it, dnsmasq binds the wildcard address, even when it is listening on only some interfaces. | help + man |
-Z, --read-ethers | Read /etc/ethers for information about hosts for the DHCP server. | help + man |
-1, --enable-dbus busname | Allow dnsmasq configuration to be updated via DBus method calls. | help + man |
--enable-ubus busname | Enable the UBus interface. | help |
-2, --no-dhcp-interface interface | Do not provide DHCP, TFTP or router advertisement on the specified interface, but do provide DNS service. | help + man |
--no-dhcpv6-interface interface | Disable IPv6 DHCP and router advertisement on the specified interface. | help + man |
--no-dhcpv4-interface interface | Disable only IPv4 DHCP on the specified interface. | help + man |
-3, --bootp-dynamic tag:<tag>]... | (IPv4 only) Enable dynamic allocation of IP addresses to BOOTP clients. | help + man |
-4, --dhcp-mac set:<tag | Map MAC address (with wildcards) to option set. | help + man |
--bridge-interface iface | Treat DHCP requests on aliases as arriving from interface. | help |
--shared-network iface>|<addr | Specify extra networks sharing a broadcast domain for DHCP | help + man |
--leasequery addr>[/prefix | Enable RFC 4388 leasequery functions for DHCPv4 | help |
-5, --no-ping | (IPv4 only) By default, the DHCP server will attempt to ensure that an address is not in use before allocating it to a host. | help + man |
-6, --dhcp-script path | Whenever a new DHCP lease is created, or an old one destroyed, or a TFTP file transfer completes, the executable specified by this option is run. | help + man |
--dhcp-luascript path | Specify a script written in Lua, to be run when leases are created, destroyed or changed. | help + man |
--dhcp-scriptuser username | Specify the user as which to run the lease-change script or Lua script. | help + man |
--script-arp | Enable the "arp" and "arp-old" functions in the --dhcp-script and --dhcp-luascript. | help + man |
-7, --conf-dir path | Read all the files in the given directory as configuration files. | help + man |
--conf-script path | Execute file and read configuration from stdin. | help |
-8, --log-facility facility>|<file | Set the facility to which dnsmasq will send syslog entries, this defaults to DAEMON, and to LOCAL0 when debug mode is in operation. | help + man |
-9, --leasefile-ro | Completely suppress use of the lease database file. | help + man |
-0, --dns-forward-max integer | Set the maximum number of concurrent DNS queries. | help + man |
--clear-on-reload | Whenever /etc/resolv.conf is re-read or the upstream servers are set via DBus, clear the DNS cache. | help + man |
--dhcp-ignore-names tag:<tag>]... | Ignore hostnames provided by DHCP clients. | help |
--dhcp-no-override | (IPv4 only) Disable re-use of the DHCP servername and filename fields as extra option space. | help + man |
--enable-tftp intr | Enable integrated read-only TFTP server. | help |
--tftp-root dir | Export files by TFTP only from the specified subtree. | help |
--tftp-unique-root ip|mac | Add client IP or hardware address to tftp-root. | help |
--tftp-secure | Enable TFTP secure mode: without this, any file which is readable by the dnsmasq process under normal unix access-control rules is available via TFTP. | help + man |
--tftp-no-fail | Do not abort startup if specified tftp root directories are inaccessible. | help + man |
--tftp-max integer | Set the maximum number of concurrent TFTP connections allowed. | help + man |
--tftp-mtu integer | Use size as the ceiling of the MTU supported by the intervening network when negotiating TFTP blocksize, overriding the MTU setting of the local interface if it is larger. | help + man |
--tftp-no-blocksize | Stop the TFTP server from negotiating the "blocksize" option with a client. | help + man |
--tftp-lowercase | Convert filenames in TFTP requests to all lowercase. | help + man |
--tftp-port-range start | A TFTP server listens on a well-known port (69) for connection initiation, but it also uses a dynamically-allocated port for each connection. | help + man |
--tftp-single-port | Run in a mode where the TFTP server uses ONLY the well-known port (69) for its end of the TFTP transfer. | help + man |
--log-dhcp | Extra logging for DHCP: log all the options sent to DHCP clients and the tags used to determine them. | help + man |
--log-async integer | Enable async. | help |
--stop-dns-rebind | Reject (and log) addresses from upstream nameservers which are in the private ranges. | help + man |
--rebind-localhost-ok | Exempt 127.0.0.0/8 and ::1 from rebinding checks. | help + man |
--rebind-domain-ok /<domain>/ | Inhibit DNS-rebind protection on this domain. | help |
--all-servers | By default, when dnsmasq has more than one upstream server available, it will send queries to just one server. | help + man |
--dhcp-match set:<tag | Set tag if client includes matching option in request. | help |
--dhcp-name-match set:<tag | Set tag if client provides given name. | help |
--dhcp-alternate-port ports | Use alternative ports for DHCP. | help |
--naptr-record name | Specify NAPTR DNS record. | help |
--min-port port | Do not use ports less than that given as source for outbound DNS queries. | help + man |
--max-port port | Use ports lower than that given as source for outbound DNS queries. | help + man |
--dhcp-fqdn | In the default mode, dnsmasq inserts the unqualified names of DHCP clients into the DNS. | help + man |
--dhcp-generate-names tag:<tag | Generate hostnames based on MAC address for nameless clients. | help |
--dhcp-proxy ipaddr>]... | Use these DHCP relays as full proxies. | help |
--dhcp-relay local-addr | Relay DHCP requests to a remote server | help |
--dhcp-split-relay local-addr | Relay DHCP requests to a remote server | help |
--cname alias | Specify alias name for LOCAL DNS name. | help |
--pxe-prompt prompt | Prompt to send to PXE clients. | help |
--pxe-service service | Boot service for PXE menu. | help |
--test | Read and syntax check configuration file(s). | help + man |
--add-mac base64|text | Add requestor's MAC address to forwarded DNS queries. | help |
--strip-mac | Remove any MAC address information already in downstream queries before forwarding upstream. | help + man |
--add-subnet v4 | Add specified IP subnet to forwarded DNS queries. | help |
--strip-subnet | Remove any subnet address already present in a downstream query before forwarding it upstream. | help + man |
--add-cpe-id text | Add an arbitrary identifying string to DNS queries which are forwarded upstream. | help + man |
--proxy-dnssec | Copy the DNSSEC Authenticated Data bit from upstream servers to downstream clients. | help + man |
--dhcp-sequential-ip | Dnsmasq is designed to choose IP addresses for DHCP clients using a hash of the client's MAC address. | help + man |
--dhcp-ignore-clid | Dnsmasq is reading 'client identifier' (RFC 2131) option sent by clients (if available) to identify clients. | help + man |
--conntrack | Read the Linux connection track mark associated with incoming DNS queries and set the same mark value on upstream traffic used to answer those queries. | help + man |
--dhcp-client-update | Normally, when giving a DHCP lease, dnsmasq sets flags in the FQDN option to tell the client not to attempt a DDNS update with its name and IP address. | help + man |
--enable-ra | Send router-advertisements for interfaces doing DHCPv6 | help + man |
--dhcp-duid enterprise | (IPv6 only) Specify the server persistent UID which the DHCPv6 server will use. | help + man |
--host-record name | Specify host (A/AAAA and PTR) records | help |
--caa-record name | Specify certification authority authorization record | help + man |
--dns-rr name | Specify arbitrary DNS resource record | help |
--bind-dynamic | Enable a network mode which is a hybrid between --bind-interfaces and the default. | help + man |
--auth-server NS | Export local names to global DNS | help |
--auth-zone domain | Domain to export to global DNS | help |
--auth-ttl integer | Set the TTL value returned in answers from the authoritative server. | help + man |
--auth-soa serial | Set authoritative zone information | help |
--auth-sec-servers NS | Secondary authoritative nameservers for forward domains | help |
--auth-peer ipaddr | Peers which are allowed to do zone transfer | help |
--ipset /<domain>[/<domain>...]/<ipset>... | Specify ipsets to which matching domains should be added | help |
--nftset /<domain>[/<domain>...]/<nftset>... | Specify nftables sets to which matching domains should be added | help |
--connmark-allowlist-enable mask | Enable filtering of DNS queries with connection-track marks. | help |
--synth-domain domain | Specify a domain and address range for synthesised names | help |
--dnssec | Validate DNS replies and cache DNSSEC data. | help + man |
--trust-anchor domain | Specify trust anchor key digest. | help |
--dnssec-debug | Set debugging mode for the DNSSEC validation, set the Checking Disabled bit on upstream queries, and don't convert replies which do not validate to responses with a return code of SERVFAIL. | help + man |
--dnssec-check-unsigned | Ensure answers without DNSSEC are in unsigned zones. | help |
--dnssec-no-timecheck | DNSSEC signatures are only valid for specified time windows, and should be rejected outside those windows. | help + man |
--dnssec-timestamp path | Enables an alternative way of checking the validity of the system time for DNSSEC (see --dnssec-no-timecheck). | help + man |
--dnssec-limits limit | Set resource limits for DNSSEC validation | help |
--quiet-dhcp | Suppress logging of the routine operation of these protocols. | help + man |
--quiet-dhcp6 | Do not log routine DHCPv6. | help |
--quiet-ra | Do not log RA. | help |
--log-debug | Enable extra logging intended for debugging rather than information. | help + man |
--local-service | Accept queries only from directly-connected networks. | help |
--dns-loop-detect | Enable code to detect DNS forwarding loops; | help + man |
--ignore-address ipaddr | Ignore DNS responses containing ipaddr. | help |
--dhcp-ttl ttl | As for --local-ttl, but affects only replies with information from DHCP leases. | help + man |
--dhcp-reply-delay integer | Delay DHCP replies for at least number of seconds. | help |
--dhcp-rapid-commit | Enable DHCPv4 Rapid Commit Option specified in RFC 4039. | help + man |
--dumpfile path | Specify the location of a pcap-format file which dnsmasq uses to dump copies of network packets for debugging purposes. | help + man |
--dumpmask hex | Specify which types of packets should be added to the dumpfile. | help + man |
--script-on-renewal | Call the DHCP script when the lease expiry time changes, for instance when the lease is renewed. | help + man |
--umbrella optspec | Send Cisco Umbrella identifiers including remote IP. | help |
--quiet-tftp | Do not log routine TFTP. | help |
--no-round-robin | Dnsmasq normally permutes the order of A or AAAA records for the same name on successive queries, for load-balancing. | help + man |
--no-0x20-encode | Suppress DNS bit 0x20 encoding. | help |
--do-0x20-encode | Dnsmasq can scramble the case of letters in DNS queries it sends upstream as a security feature. | help + man |
--no-ident | Do not respond to class CHAOS and type TXT in domain bind queries. | help + man |
--cache-rr RR-type | Cache this DNS resource record type. | help |
--max-tcp-connections integer | The maximum number of concurrent TCP connections. | help + man |
--log-malloc | Enable logging of memory allocation and release, for debugging. | help + man |
Exit status (6) from the manual page
0 | Dnsmasq successfully forked into the background, or terminated normally if backgrounding is not enabled. |
1 | A problem with configuration was detected. |
2 | A problem with network access occurred (address in use, attempt to use privileged ports without permission). |
3 | A problem occurred with a filesystem operation (missing file/directory, permissions). |
4 | Memory allocation failure. |
5 | Other miscellaneous problem. |