Understanding IPv6 DNS Results using dnsmasq

dnsmasq returns IPv6 DNS results by resolving AAAA records for hosts with static or DHCP-assigned IPv6 addresses, or by forwarding queries to upstream servers. You can interpret these results using tools like dig or nslookup, checking the answer section for valid IPv6 addresses. This guide explains how dnsmasq handles IPv6 resolution and how to verify its behavior.

How dnsmasq Handles IPv6 Resolution

dnsmasq is a lightweight DNS forwarder and DHCP server that supports both IPv4 and IPv6. When it receives a query for an IPv6 address (AAAA record), it follows a specific logic to determine the response. If the hostname corresponds to a device on the local network that has been assigned an IPv6 address via DHCPv6 or has a static IPv6 configuration in dnsmasq’s lease file, dnsmasq will return that address directly. For devices not managed locally, dnsmasq acts as a forwarder. It sends the query to the upstream DNS servers specified in its configuration, such as those defined in /etc/resolv.conf or a custom resolv-file. The response from these upstream servers is then cached and returned to the client. Understanding this dual role is crucial for interpreting the results you see when querying dnsmasq.

Local Hosts and DHCPv6

If your network uses DHCPv6 to assign IPv6 addresses, dnsmasq tracks these assignments in its lease file, typically located at /var/lib/misc/dnsmasq.leases. When a client requests the IPv6 address of a host, dnsmasq checks this file. If the host is present and has a valid IPv6 address, dnsmasq returns it immediately without contacting upstream servers. This reduces latency and external dependency for local resources. You can verify if a host has an IPv6 lease by examining the lease file. Look for entries that include the MAC address, IP address, hostname, and expiry time. If the IPv6 address column is populated, dnsmasq will use it for AAAA queries. If it is empty or missing, dnsmasq may fall back to forwarding the query or returning NXDOMAIN if no other information is available.

Upstream Forwarding

For domains not hosted locally, dnsmasq forwards AAAA queries to configured upstream DNS servers. These are usually defined in the resolv-file option or inherited from /etc/resolv.conf. When dnsmasq forwards a query, it waits for a response from the upstream server. If the upstream server returns an IPv6 address, dnsmasq caches it and returns it to the client. The caching behavior depends on the TTL (Time To Live) value provided by the upstream server. Short TTLs result in more frequent lookups, while long TTLs reduce external traffic but may delay updates. You can adjust cache settings in dnsmasq’s configuration to optimize performance and freshness of DNS data.

Verifying IPv6 DNS Results

To interpret the results from dnsmasq, use standard DNS lookup tools like dig or nslookup. These tools allow you to specify the server to query, enabling you to test dnsmasq directly. For example, running dig @127.0.0.1 example.com AAAA will query the local dnsmasq instance for the IPv6 address of example.com. The output will show the answer section, which contains the resolved IPv6 address if one exists. Check for flags such as AD (Authenticated Data) or TC (Truncated) to understand the nature of the response. A successful query will display the IPv6 address in the answer section, while a failure might show SERVFAIL or NXDOMAIN.

Using dig for Detailed Analysis

dig provides detailed information about the DNS query process. When querying dnsmasq, pay attention to the SERVER line, which confirms the server being queried. The ANSWER SECTION lists the resolved records, including their TTL and type. For IPv6, look for AAAA records containing full IPv6 addresses. If the query fails, check the STATUS field for error codes. SERVFAIL indicates a problem within dnsmasq or with upstream servers, while NXDOMAIN means the domain does not exist. Use these diagnostics to pinpoint whether the issue lies with local configuration or upstream connectivity.

Checking Cache Status

dnsmasq maintains a cache of DNS responses to improve performance. You can inspect the cache status using the dnsmasq command-line interface or by monitoring logs. Enabling debug logging with --log-queries allows you to see each query and its source, helping you trace how dnsmasq resolves names. Reviewing logs can reveal if dnsmasq is correctly forwarding queries or serving them from cache. If you notice unexpected delays or failures, check if the cache is expired or if upstream servers are unreachable. Adjusting cache sizes or clearing the cache periodically can help maintain optimal performance.

Troubleshooting Common Issues

Several common issues can affect IPv6 DNS resolution in dnsmasq. One frequent problem is misconfigured upstream servers. Ensure that the resolv-file points to valid DNS servers that support IPv6. Incorrect or unreachable upstream servers will cause queries to fail. Another issue is related to DHCPv6 configuration. If dnsmasq is not assigning IPv6 addresses correctly, hosts may not appear in the lease file, leading to failed local resolutions. Verify that DHCPv6 is enabled and properly configured in dnsmasq’s settings. Additionally, check firewall rules to ensure that UDP port 53 is open for both IPv4 and IPv6 traffic. Preventing dnsmasq from Creating AAAA Records for Hosts using DHCPv6 in Dual-Stack Networks discusses scenarios where you might want to control AAAA record generation, which is relevant if you encounter unexpected IPv6 results for hosts that should only have IPv4.

Frequently Asked Questions

Why does dnsmasq return NXDOMAIN for a known IPv6 address?

This often happens if the host is not in dnsmasq’s lease file or if the query is for a domain not handled locally. Check if DHCPv6 is correctly assigning addresses and if the hostname matches the entry in the lease file. Also, verify that upstream servers are reachable and responding correctly.

How can I force dnsmasq to forward all IPv6 queries?

You can disable local IPv6 resolution by removing hosts from the lease file or configuring dnsmasq to ignore DHCPv6 leases. Alternatively, use the no-hosts option to prevent dnsmasq from using its internal database for resolution, forcing all queries to upstream servers.

What log level should I use to debug IPv6 DNS issues?

Use the --log-queries flag to enable detailed logging of DNS queries and responses. This helps identify whether dnsmasq is serving from cache, forwarding queries, or encountering errors. Combine this with verbose logging (-v) for more comprehensive output during troubleshooting.

Can dnsmasq resolve IPv6 addresses for external domains?

Yes, dnsmasq forwards AAAA queries for external domains to upstream DNS servers. As long as the upstream servers support IPv6 and respond correctly, dnsmasq will return the resolved IPv6 addresses to clients. Ensure your upstream configuration includes reliable IPv6-capable DNS servers.

Why are my IPv6 addresses not appearing in dig results?

If dig shows no AAAA records, dnsmasq may not have the address in its cache or lease file. Verify that the host has a valid IPv6 assignment and that dnsmasq is configured to serve it. Clearing the cache or restarting dnsmasq can also help refresh stale entries.