{
  "slug": "Fixing-Blocked-Subdomain-DNS-with-Dnsmasq-on-Ubuntu----b25cc19e9877",
  "title": "Fixing Blocked Subdomain DNS with Dnsmasq on Ubuntu 🧠",
  "subtitle": "When dealing with corporate networks, restrictive firewalls, or filtered DNS resolvers, sometimes a specific subdomain gets blocked",
  "excerpt": "When dealing with corporate networks, restrictive firewalls, or filtered DNS resolvers, sometimes a specific subdomain gets blocked",
  "date": "2025-10-27",
  "tags": [
    "Linux"
  ],
  "readingTime": "2 min",
  "url": "https://medium.com/@mobinshaterian/fixing-blocked-subdomain-dns-with-dnsmasq-on-ubuntu-b25cc19e9877",
  "hero": "https://cdn-images-1.medium.com/max/800/1*aFw8b3Yqt39DmOaMc9jJXQ.png",
  "content": [
    {
      "type": "heading",
      "level": 2,
      "text": "Fixing Blocked Subdomain DNS with Dnsmasq on Ubuntu 🧠"
    },
    {
      "type": "paragraph",
      "html": "When dealing with corporate networks, restrictive firewalls, or filtered DNS resolvers, sometimes a <strong>specific subdomain gets blocked</strong> — even though the main domain works fine."
    },
    {
      "type": "paragraph",
      "html": "In this post, I’ll show how I solved a real-world case using <strong>Dnsmasq</strong> on Ubuntu to override the DNS mapping for a single subdomain that was pointing to a blocked Cloudflare IP."
    },
    {
      "type": "image",
      "src": "https://cdn-images-1.medium.com/max/800/1*aFw8b3Yqt39DmOaMc9jJXQ.png",
      "alt": "Fixing Blocked Subdomain DNS with Dnsmasq on Ubuntu 🧠",
      "caption": "",
      "width": 1024,
      "height": 1024
    },
    {
      "type": "heading",
      "level": 2,
      "text": "🚨 The Problem"
    },
    {
      "type": "paragraph",
      "html": "I had installed <strong>Dnsmasq</strong> locally on Ubuntu to manage and route DNS queries for different domains."
    },
    {
      "type": "paragraph",
      "html": "When testing connectivity, I found something strange:"
    },
    {
      "type": "code",
      "lang": "bash",
      "code": "ping datadriveninvestor.comPING datadriveninvestor.com (104.26.0.23) 56(84) bytes of data.\nping\nmedium.datadriveninvestor.comPING medium.datadriveninvestor.com (162.159.153.4) 56(84) bytes of\ndata."
    },
    {
      "type": "paragraph",
      "html": "Both domains were behind Cloudflare, but the IP <code>162.159.153.4</code> was <strong>blocked</strong> on my network, while <code>104.26.0.23</code> worked fine."
    },
    {
      "type": "paragraph",
      "html": "So even though the root domain loaded perfectly, the <code>medium.datadriveninvestor.com</code> subdomain was inaccessible."
    },
    {
      "type": "heading",
      "level": 2,
      "text": "🧩 The Goal"
    },
    {
      "type": "paragraph",
      "html": "Redirect all DNS requests for medium.datadriveninvestor.com to 104.26.0.23 without affecting other DNS behavior or domains."
    },
    {
      "type": "heading",
      "level": 2,
      "text": "⚙️ The Dnsmasq Setup"
    },
    {
      "type": "paragraph",
      "html": "Dnsmasq acts as a lightweight DNS forwarder and cache.<br>&nbsp;I already had it configured to forward different domains to custom DNS servers, something like this:"
    },
    {
      "type": "code",
      "lang": "text",
      "code": "# Listen only on loopbackinterface=lobind-interfaceslisten-address=127.0.0.1# Special DNS\nserversserver=/google.com/10.131.57.151server=/datadriveninvestor.com/76.76.2.11"
    },
    {
      "type": "paragraph",
      "html": "This setup meant that all subdomains of <code>datadriveninvestor.com</code> were being resolved through the DNS server at <code>76.76.2.11</code>."
    },
    {
      "type": "paragraph",
      "html": "That includes the problematic subdomain <code>medium.datadriveninvestor.com</code>."
    },
    {
      "type": "heading",
      "level": 2,
      "text": "🛠 The Solution: Override the IP Manually"
    },
    {
      "type": "paragraph",
      "html": "Dnsmasq allows you to <strong>force specific domains to resolve to a fixed IP address</strong> using the <code>address=</code> directive."
    },
    {
      "type": "paragraph",
      "html": "So I added this line to <code>/etc/dnsmasq.conf</code>:"
    },
    {
      "type": "code",
      "lang": "text",
      "code": "address=/medium.datadriveninvestor.com/104.26.0.23"
    },
    {
      "type": "paragraph",
      "html": "This tells Dnsmasq:"
    },
    {
      "type": "quote",
      "html": "<em>Whenever someone queries </em><code><em>medium.datadriveninvestor.com</em></code><em>, return </em><code><em>104.26.0.23</em></code><em> directly — no upstream lookup.</em>"
    },
    {
      "type": "paragraph",
      "html": "Here’s the relevant part of the final configuration:"
    },
    {
      "type": "code",
      "lang": "text",
      "code": "# Listen only on loopbackinterface=lobind-interfaceslisten-address=127.0.0.1# Override blocked\nsubdomainaddress=/medium.datadriveninvestor.com/104.26.0.23# Custom DNS servers for\ndomainsserver=/datadriveninvestor.com/76.76.2.11server=/medium.com/76.76.2.11# Default and fallback\nDNS serversserver=9.9.9.9server=8.8.8.8# Security &\nperformancedomain-neededbogus-privno-resolvno-pollcache-size=1000"
    },
    {
      "type": "heading",
      "level": 2,
      "text": "⚡ Applying the Changes"
    },
    {
      "type": "paragraph",
      "html": "After editing, restart the Dnsmasq service:"
    },
    {
      "type": "code",
      "lang": "bash",
      "code": "sudo systemctl restart dnsmasq"
    },
    {
      "type": "paragraph",
      "html": "Then verify:"
    },
    {
      "type": "code",
      "lang": "bash",
      "code": "dig medium.datadriveninvestor.com @127.0.0.1"
    },
    {
      "type": "paragraph",
      "html": "✅ You should see:"
    },
    {
      "type": "code",
      "lang": "text",
      "code": ";; ANSWER SECTION:medium.datadriveninvestor.com. 0 IN A 104.26.0.23"
    },
    {
      "type": "paragraph",
      "html": "And <code>ping</code> confirms the fix:"
    },
    {
      "type": "code",
      "lang": "bash",
      "code": "ping medium.datadriveninvestor.comPING medium.datadriveninvestor.com (104.26.0.23) 56(84) bytes of\ndata."
    },
    {
      "type": "heading",
      "level": 2,
      "text": "Failed to set DNS configuration: Unit dbus-org.freedesktop.resolve1.service not found."
    },
    {
      "type": "code",
      "lang": "text",
      "code": "echo 'dbus=NO' | sudo tee -a /etc/resolvconf.conf"
    },
    {
      "type": "code",
      "lang": "bash",
      "code": "sudo cat /etc/resolv.conf#nameserver 127.0.0.53#options edns0 trust-ad#search\nmtnirancell.irnameserver 127.0.0.1nameserver 8.8.8.8nameserver 1.1.1.1"
    },
    {
      "type": "heading",
      "level": 2,
      "text": "🧠 Why This Works"
    },
    {
      "type": "list",
      "ordered": false,
      "items": [
        "The <code>server=/domain/</code> directive tells Dnsmasq <strong>where to forward queries</strong> for that domain.",
        "The <code>address=/domain/ip</code> directive <strong>short-circuits</strong> that process — Dnsmasq answers directly with the given IP.",
        "<code>address=</code> rules take <strong>priority</strong> over <code>server=</code> rules, so even if another DNS server is set for that domain, the override wins."
      ]
    },
    {
      "type": "heading",
      "level": 2,
      "text": "✅ Conclusion"
    },
    {
      "type": "paragraph",
      "html": "When a subdomain resolves to a <strong>blocked or unwanted IP</strong>, you don’t have to modify your entire DNS setup.<br>&nbsp;With Dnsmasq, a single <code>address=</code> line can override any domain mapping — giving you total control over your DNS resolution."
    },
    {
      "type": "paragraph",
      "html": "<strong>In short:</strong>"
    },
    {
      "type": "quote",
      "html": "<em>🧭 Dnsmasq gives you local control when the internet (or your network admin) doesn’t.</em>"
    }
  ]
}