summaryrefslogtreecommitdiff
path: root/man/dnsmasq.8
diff options
context:
space:
mode:
authorSimon Kelley <simon@thekelleys.org.uk>2021-03-17 20:31:06 +0000
committerSimon Kelley <simon@thekelleys.org.uk>2021-03-17 20:31:06 +0000
commit9eaa91bfc32e40f3e9c6ac1d86c0c284f09e0d3f (patch)
treea72f75f886028225665d033c8e53c9f04367abc6 /man/dnsmasq.8
parent484bd75ce48ade2c34f730c16e783da284a0a509 (diff)
downloaddnsmasq-9eaa91bfc32e40f3e9c6ac1d86c0c284f09e0d3f.tar.gz
Teach --bogus-nxdomain and --ignore-address to take a subnet argument.
Diffstat (limited to 'man/dnsmasq.8')
-rw-r--r--man/dnsmasq.88
1 files changed, 4 insertions, 4 deletions
diff --git a/man/dnsmasq.8 b/man/dnsmasq.8
index 6dee5a4..8473acf 100644
--- a/man/dnsmasq.8
+++ b/man/dnsmasq.8
@@ -326,8 +326,8 @@ are re-written. So
.B --alias=192.168.0.10-192.168.0.40,10.0.0.0,255.255.255.0
maps 192.168.0.10->192.168.0.40 to 10.0.0.10->10.0.0.40
.TP
-.B \-B, --bogus-nxdomain=<ipaddr>
-Transform replies which contain the IP address given into "No such
+.B \-B, --bogus-nxdomain=<ipaddr>[/prefix]
+Transform replies which contain the IP specified address or subnet into "No such
domain" replies. This is intended to counteract a devious move made by
Verisign in September 2003 when they started returning the address of
an advertising web page in response to queries for unregistered names,
@@ -335,8 +335,8 @@ instead of the correct NXDOMAIN response. This option tells dnsmasq to
fake the correct response when it sees this behaviour. As at Sept 2003
the IP address being returned by Verisign is 64.94.110.11
.TP
-.B --ignore-address=<ipaddr>
-Ignore replies to A-record queries which include the specified address.
+.B --ignore-address=<ipaddr>[/prefix]
+Ignore replies to A-record queries which include the specified address or subnet.
No error is generated, dnsmasq simply continues to listen for another reply.
This is useful to defeat blocking strategies which rely on quickly supplying a
forged answer to a DNS request for certain domain, before the correct answer can arrive.