dnsmasq

Search for dnsmasq in Azure Marketplace, select the SecureAnyCloud publisher, and choose Create.

Configure the network security group to allow UDP 53 and TCP 53 (DNS) from your client networks, and TCP 22 for administration. DNS uses UDP 53 for most queries and falls back to TCP 53 for large responses, so open both.

RG="dns-prod"; LOCATION="eastus"; VM_NAME="dnsmasq1" IMAGE_URN="sac1647283583153:dnsmasq:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:dnsmasq:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
# Open the DNS and admin ports on the VM's NSG:
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 53 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1002

On first boot, the image resolves the VM public IP and asserts the secure defaults (local-service on, DHCP and TFTP off). It tests the dnsmasq configuration and starts the service. It proves that the local record answers and that upstream forwarding works. Finally, it writes /root/dnsmasq-credentials.txt.

First boot completes within a minute. SSH in as azureuser and read the details:

sudo cat /root/dnsmasq-credentials.txt

dnsmasq.service is active and owns port 53. ss confirms that dnsmasq is the listener on :53 for both UDP and TCP.

systemctl is-active dnsmasq.service
sudo ss -tulnp | grep -E ':53 ' || echo "(dnsmasq is not yet listening on :53)"

The image ships one local example record, ns.dnsmasq.internal, so a DNS round trip works immediately without any upstream. Forwarding of external names to the upstream resolvers also works out of the box.

Query the loopback address, or the VM public IP from a client:

dig @127.0.0.1 ns.dnsmasq.internal +short dig @127.0.0.1 example.com +short

The SecureAnyCloud configuration lives in /etc/dnsmasq.d/00-sac.conf. The command dnsmasq --test validates the whole configuration. The version is 2.90 from the Ubuntu archive.

dnsmasq --version | head -1 sudo dnsmasq --test cat /etc/dnsmasq.d/00-sac.conf

This check covers the key security property. local-service is present, so the server answers only local subnet clients and is not an open resolver. There is no dhcp-range and no enable-tftp, so DHCP and TFTP are off by default.

grep -E '^\s*(local-service|no-resolv|domain-needed|bogus-priv)' /etc/dnsmasq.d/00-sac.conf echo '--- DHCP and TFTP are off by default (the next command returns nothing): ---'
grep -E '^\s*(dhcp-range|enable-tftp)' /etc/dnsmasq.d/00-sac.conf || echo 'confirmed: no dhcp-range and no enable-tftp are set'

Configure the devices or the router on your local network to use the VM as their DNS server. On a Linux client, set the nameserver to the VM address. Replace <public-ip> with the VM public IP, or with its private IP inside the VNet:

echo "nameserver <public-ip>" | sudo tee /etc/resolv.conf

Because of local-service, dnsmasq answers only clients whose address is on a subnet local to the VM. Keep the server and its clients on the same VNet or a peered network.

dnsmasq can hand out DHCP leases on a subnet you control. Enable DHCP only on a network where you are the intended DHCP server.

Add a stanza like the following to /etc/dnsmasq.d/00-sac.conf. Adjust the interface and range to your subnet:

interface=eth0 dhcp-range=192.0.2.50,192.0.2.150,255.255.255.0,12h dhcp-option=option:router,192.0.2.1

Open UDP 67 in the network security group, then restart the service with sudo systemctl restart dnsmasq.

Adding an interface= line also disables local-service. If you enable DHCP, add an explicit except-interface or an address-based restriction. This keeps the DNS forwarder from answering untrusted sources.

dnsmasq includes a TFTP server for network boot. To serve a TFTP root, add the following to /etc/dnsmasq.d/00-sac.conf:

enable-tftp tftp-root=/srv/tftp dhcp-boot=pxelinux.0

Create /srv/tftp and place your boot files there. Open UDP 69 in the network security group, and restart with sudo systemctl restart dnsmasq.

Keep the TFTP root read-only, and populate it with only the files you intend to serve.

To add your own local names or change the upstream resolvers, add a file such as /etc/dnsmasq.d/50-local.conf:

# local names answered directly by dnsmasq host-record=app.internal,10.0.0.20 address=/dev.internal/10.0.0.30
# use your own upstream resolvers instead of the defaults server=10.0.0.1

Validate with sudo dnsmasq --test and apply with sudo systemctl reload dnsmasq.

Restrict the network security group. Allow UDP and TCP 53 only from the client networks that need to query the server, and TCP 22 for administration only.

Keep it a local service. The shipped local-service default means the server never answers the public internet. If you add an interface= line for DHCP, add an explicit source restriction again, so the DNS forwarder does not become an open resolver.

Enable DHCP and TFTP only where you own the network. A stray DHCP server or an open TFTP root on someone else's network is a security incident.

Keep the OS and dnsmasq patched. Unattended security upgrades remain enabled on the running VM.

Monitor the leases file. If you enable DHCP, /var/lib/misc/dnsmasq.leases records active leases.

dnsmasq is free software written by Simon Kelley and distributed under the GNU General Public License, version 2 (GPL-2.0). This SecureAnyCloud image bundles the unmodified Ubuntu archive package.

SecureAnyCloud provides the packaging and the secure caching forwarder hardening. It also provides the not-an-open-resolver defaults, the DHCP-and-TFTP-off-by-default posture and the local example record. Support is 24/7, with a guaranteed 24-hour response SLA.

SecureAnyCloud is not affiliated with or endorsed by the dnsmasq project or Simon Kelley. dnsmasq is used here only to identify the software.

Deploy on Azure

Find dnsmasq on Ubuntu 24.04 LTS in Azure Marketplace, published by SecureAnyCloud. Deploy from the Azure Portal or the Azure CLI as shown above.

Need Help?

Email sales@secureanycloud.com for deployment help, configuration questions or licensing inquiries.

Deploy on Azure

Launch dnsmasq 2.90 on Ubuntu 24.04 LTS on Azure, with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Search for dnsmasq in AWS Marketplace and select the SecureAnyCloud listing. Choose Continue to Subscribe, then Continue to Configuration, then Continue to Launch.

Choose the m5.large instance type, your key pair and a security group. Configure the security group to allow UDP 53 and TCP 53 from the clients that will query the server, and TCP 22 for administration. Keep port 53 restricted to the internal subnets whose clients will use the resolver.

AWS_REGION="us-east-1" aws ec2 run-instances \
  --region "$AWS_REGION" \
  --image-id <dnsmasq-ami-id> \
  --instance-type m5.large \
  --key-name <your-key-pair> \
  --security-group-ids <your-sg-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=dnsmasq1}]'

Open UDP 53, TCP 53 and TCP 22 in <your-sg-id>, scoped to the sources that need them.

On first boot, the image resolves this instance's IP through EC2 instance metadata (IMDSv2) for the endpoint notes. It reasserts that the shipped configuration is secure, meaning that local-service is set and that DHCP and TFTP are off. It verifies the configuration syntax with dnsmasq --test and starts dnsmasq. It proves that both the local record and upstream forwarding are answering. Finally, it writes the informational note /root/dnsmasq-aws-info.txt.

First boot completes within seconds. SSH in as ubuntu and read the note:

sudo cat /root/dnsmasq-aws-info.txt

The note records this instance's DNS endpoint and example queries. dnsmasq has no password, so the note holds no secret. The note is 0600 root:root.

dnsmasq.service is active, and dnsmasq --version reports 2.90. ss confirms that dnsmasq is listening on :53 for DNS over both UDP and TCP.

systemctl is-active dnsmasq.service dnsmasq --version | head -1 sudo ss -tulnp | grep ':53 '

dnsmasq answers the demonstration record ns.dnsmasq.internal locally, so a DNS round trip works immediately with no upstream needed. A query for an external name is forwarded to the upstream resolvers and cached.

dig +noall +answer @127.0.0.1 ns.dnsmasq.internal dig +short @127.0.0.1 example.com

The first query returns 10.0.0.53, the shipped local record, answered straight from dnsmasq. The second query is forwarded to the upstream resolvers 1.1.1.1 and 9.9.9.9, and it returns the real address for the name.

Everything dnsmasq does is in /etc/dnsmasq.d/00-sac.conf. The shipped configuration sets local-service and ignores the host resolver list. It forwards to explicit upstreams and refuses to forward unqualified names and private reverse lookups. It caches answers and serves the demonstration record.

sudo grep -vE '^\s*#|^\s*$' /etc/dnsmasq.d/00-sac.conf

This is the security posture that matters for a public-facing DNS server. Because local-service is set, dnsmasq answers DNS only for clients whose source address is on a local subnet of the instance. It silently drops queries from any other source, so it cannot be abused for DNS amplification. DHCP and TFTP ship off. Confirm all three from the shipped configuration:

grep -E '^\s*local-service' /etc/dnsmasq.d/00-sac.conf && echo 'local-service: ON'
grep -qE '^\s*dhcp-range' /etc/dnsmasq.d/00-sac.conf && echo 'DHCP: on' || echo 'DHCP: OFF by default'
grep -qE '^\s*enable-tftp' /etc/dnsmasq.d/00-sac.conf && echo 'TFTP: on' || echo 'TFTP: OFF by default'

With local-service set, dnsmasq answers a query from a client on the instance's own subnet. It drops a query that arrives from an off-subnet source, for example the open internet.

local-service takes effect only while no interface= or listen-address= option is set, so this image deliberately pins neither.

local-service answers clients on subnets that the instance itself has an interface on. In a typical VPC deployment, that is your instance's own subnet, which is what you want.

To serve clients on other subnets you control, add explicit interface or address bindings, or replace local-service with a more specific setting. A common pattern is to bind dnsmasq to the private interface and allow your VPC CIDR. Edit /etc/dnsmasq.d/00-sac.conf, make your change, then restart:

# example: after editing the configuration to widen the served client scope
sudo dnsmasq --test sudo systemctl restart dnsmasq

Always run dnsmasq --test first. It validates the configuration, and dnsmasq refuses to start on a syntax error. Keep the served scope to networks you control, so the server never becomes an open resolver.

dnsmasq is also a DHCP server, and it ships off. To hand out addresses on a subnet you own, add an interface and a dhcp-range, open UDP 67 in the security group, and restart. Never run DHCP on a subnet you do not control.

# add to /etc/dnsmasq.d/00-sac.conf, adjusting the interface and range to your subnet:
# interface=eth0
# dhcp-range=192.0.2.50,192.0.2.150,255.255.255.0,12h
sudo dnsmasq --test sudo systemctl restart dnsmasq

dnsmasq then answers DHCP on the named interface. It also resolves the names of the hosts it leases, so DNS and DHCP stay consistent.

dnsmasq includes a TFTP server for network boot, and it ships off. To serve TFTP, add enable-tftp and a tftp-root, open UDP 69 in the security group, and restart. Combine it with the DHCP boot options for PXE.

# add to /etc/dnsmasq.d/00-sac.conf:
# enable-tftp
# tftp-root=/srv/tftp
sudo mkdir -p /srv/tftp
sudo dnsmasq --test sudo systemctl restart dnsmasq

Keep the TFTP root to files you intend to serve. Restrict UDP 69 to the network that boots from it.

Everything dnsmasq does is in its configuration files, and the per-instance details are in the info note. Read both with sudo.

sudo cat /etc/dnsmasq.d/00-sac.conf
sudo cat /root/dnsmasq-aws-info.txt

The info note is 0600 root:root and holds no secret. It records this instance's DNS endpoint and example queries for convenience.

Restrict the security group to your use case. Allow UDP 53 and TCP 53 only from the client subnets that will query the resolver, and TCP 22 only from your administration address. Open UDP 67 (DHCP) or UDP 69 (TFTP) only if you enable those services, and only to the network that uses them.

Keep the served scope tight. local-service keeps the resolver from answering off-subnet clients. If you widen the scope, add only networks you control, so the server never becomes an open resolver.

Never run DHCP on a network you do not own. A rogue DHCP server disrupts every client on the segment. Enable DHCP only on subnets you control.

Keep the TFTP root minimal. Serve only the boot files you intend to, and keep UDP 69 restricted.

Keep the OS patched. Unattended security upgrades remain enabled on the running instance.

dnsmasq is free software by Simon Kelley, distributed under the GNU General Public License, version 2 or version 3. The shipped package declares GPL-2 or GPL-3. This SecureAnyCloud image bundles the unmodified dnsmasq package from the operating system archive.

SecureAnyCloud provides the packaging, the systemd hardening, and the secure-by-default, not-an-open-resolver configuration. It also provides the per-instance first-boot automation, the paired deploy guide and 24/7 support.

SecureAnyCloud is not affiliated with or endorsed by the dnsmasq project or Simon Kelley. dnsmasq is used here only to identify the software.

Deploy on AWS

Find dnsmasq in AWS Marketplace, published by SecureAnyCloud. Launch from the AWS console or the AWS CLI as shown above.

Need Help?

Email sales@secureanycloud.com for deployment help, configuration questions or licensing inquiries.

Deploy on AWS

Launch dnsmasq on AWS, with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com