The dnsfunneld program

dnsfunneld is a small DNS forwarder daemon. It receives DNS queries from clients, then forwards them to one or more DNS caches. It collects the responses and forwards them back to the clients. Depending on the options it is given, it may perform light processing on the queries, the responses, or both.


     dnsfunneld [ -v verbosity ] [ -1 ] [ -U | -u uid -g gid ] [ -i ip ] [ -p port ] [ -R root ] [ -b bufsize ] [ -t globaltimeout ] [ -X | -x ] [ -N | -n ]


Exit codes


The other options control the activation or deactivation of various features. See below for the detail of operations.

DNS forwarding behaviour

dnsfunneld operations

Depending on the options it has been given, dnsfunneld may perform the following operations on the queries or responses it receives:


If a DNS response is more than 510 bytes long, dnsfunneld will truncate the last resource records in the response, until it fits into 510 bytes and can be given to the client in a UDP packet. The structure of a DNS packet makes it so the RRs are listed in order of decreasing importance, so keeping as many RRs as will fit in 510 bytes without reordering them is the natural way of truncating a response.

NXDOMAIN workaround

Some DNS servers incorrectly answer NXDOMAIN when they should just answer NODATA, and querying for another, existing, record type for the same domain allows dnsfunneld to tell the difference between a real NXDOMAIN. When that operation is requested, for every A or AAAA query dnsfunneld receives and forwards, it also sends an additional AAAA or A query for the same domain. If the main query returns NXDOMAIN, dnsfunneld waits for the response to the auxiliary query: if this response is not NXDOMAIN, then dnsfunneld answers NODATA to the client instead of NXDOMAIN. Be aware that activating this workaround can practically double the number of queries sent to the DNS caches, and may cause additional delays before the clients get their answers.