dnsmasq not working on Mac OS Sierra

Question

I'm running dnsmasq on a 2016 MBP running Mac OS Sierra (10.12.1) but I'm unable to ping any .dev addresses despite having what I believe is the proper config. Running dig does return sane output.

/usr/local/etc/dnsmasq.conf

resolv-file=/usr/local/etc/resolv-dnsmasq.conf
address=/.dev/127.0.0.1

/etc/resolver/dev

nameserver 127.0.0.1

/usr/local/etc/resolv-dnsmasq.conf

nameserver 8.8.8.8
nameserver 8.8.4.4

My DNS server list in System Preferences has only one entry pointing to 127.0.0.1.

When I run dig on a .dev address I get the following output:

; <<>> DiG 9.11.0-P1 <<>> test.dev
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36126
;; flags: qr aa rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;test.dev.          IN  A

;; ANSWER SECTION:
test.dev.       0   IN  A   127.0.0.1

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Dec 19 23:13:20 PST 2016
;; MSG SIZE  rcvd: 42

I'm able to load external sites like google.com perfectly but if I try accessing a local web server or even pinging a .dev address it fails.

Help would be appreciated!

Answer 1

Your dnsmasq daemon isn't properly configured.

Your external resolver is working: all queries to non-dev hosts/domains are forwarded to 3rd-party DNS servers with the resolv-file=/usr/local/etc/resolv-dnsmasq.conf line - in your case the configured file contains two public Google DNS servers.

Your internal resolver doesn't resolve internal names though.

The line address=/.dev/127.0.0.1 or better address=/dev/127.0.0.1 will redirect any *.dev query to the host 127.0.0.1. An internal resolver is not needed then and the internal name server defined in /etc/resolver/dev is useless.

Compare this with the example in the dnsmasq.conf file:

# Add domains which you want to force to an IP address here.
# The example below send any host in double-click.net to a local
# web-server.
#address=/double-click.net/127.0.0.1

Any query for *.double-click.net will be redirected to 127.0.0.1 and to an arbitrary website served at localhost.

I strongly recommend to define a hosts.config file and enter/define all necessary hosts there:

Add a line addn-hosts=/usr/local/etc/hosts/hosts.conf in dnsmasq.conf. Then add a folder with sudo mkdir /usr/local/etc/hosts and create a file hosts.conf

sudo nano /usr/local/etc/hosts/hosts.conf

with the following content:

127.0.0.1   localhost
127.0.0.1   test.dev
127.0.0.1   test2.dev
...

After saving the file reload your dnsmasq daemon.

If you want to use different IPs for your host names e.g.:

127.0.0.1   localhost
127.0.0.2   test.dev
127.0.0.3   test2.dev
...

you'd have to add additional IPs with:

sudo ifconfig lo0 alias 127.0.0.2 up
sudo ifconfig lo0 alias 127.0.0.3 up
...

Answer 2

The .dev TLD is no longer usable by developers as a private TLD. I ran into this, and had to change things to use ".priv" or something else instead. The ".dev" TLD is no longer a private thing, as it now belongs to Google, and is treated in a special way by Chrome and other browsers.

Following is a clip from the following article: https://www.tomshardware.com/news/google-enforces-https-tld-hsts,35564.html

"Google announced that 45 of the top-level domains (TLDs) it recently purchased, including .dev, .app, .eat, and so on, will enforce HTTPS security, guaranteeing that all connections to sites using those TLDs will be over encrypted channels."