DNS whitelist domains

Question

I'm trying to set a couple of DNS servers to resolve only specified domains. My first attempt was to run DNSmasq and create a manual list of domains/IPs, like so:

no-resolv
address=/whatsapp.com/192.155.212.202

But big services like google, twitter, whatsapp, facebook, etc.. use several IP ranges and distribute them in different ways (subdomains, protocols, geolocation, device type of the client, etc.), and this is causing some troubles.

I think the simplest approach would be to say something like:

Forward DNS queries of these domains to resolv.conf and block anything else

Is there a way to do it?

Solution

You're looking for the server= directive instead of the address= directive. Unfortunately, you'll have to specify your actual DNS servers, it won't get them from resolv.conf (since you are using no-resolv to prevent that).

server=/whatsapp.com/8.8.8.8
server=/whatsapp.com/8.8.4.4
server=/example.com/8.8.8.8
server=/example.com/8.8.4.4
⋮

You probably want to generate that with a script. And of course you can use your normal DNS servers instead of Google Public DNS.

Alternatively, you can use BIND (though note that there are other configs if your goal isn't filtering).

Comments

[Rob]

It looks like BIND doesn't do whitelisting, only blacklisting.

[mencargo]

server= directive needs the server always, if server is not specified it will only look into hosts to find address, it won't try to query other DNS

[KajMagnus]

The server=/.... lines — one adds them to /etc/dnsmasq.conf? (that's the right file, on Debian?)

[derobert]

@KajMagnus yeah, or a file in the .d directory if you have that.

[KajMagnus]

@derobert Thanks — this looks simpler than installing Pi-hole.