Running Dnsmasq in Docker as an Internal DNS Server for a Home LAN

Resolving my own domain inside the LAN with dnsmasq on Docker

 Posted on March 15, 2021  (Last modified on August 19, 2026)  • Other languages: 日本語
* This page contains promotional content

On my home server I use my own domain and run several servers on it, but from inside the home LAN the traffic goes through the router, so accessing them with my own domain does not reach the servers inside the house

It is easier to understand if you refer to this article

When you only have a few PCs and devices, you can write the entries in each hosts file instead of introducing dnsmasq, but I also wanted to manage the hosts file in one place, so I built dnsmasq as a DNS server inside the LAN with Docker

Layout

$ tree
.
├── dnsmasq.conf
├── docker-compose.yml
└── hosts-dnsmasq

Putting the hosts entries in a separate file

Create hosts-dnsmasq and write the entries into it

192.168.1.1    test1.example.com
192.168.1.1    test2.example.com
192.168.1.1    test3.example.com
192.168.1.1    test4 foo bar

docker-compose

Starting it up and checking it

$ docker-compose up -d
$ dig @127.0.0.1 test1.example.com
...
;; ANSWER SECTION:
test1.example.com.	0	IN	A	192.168.1.1

Check that the ANSWER SECTION shows what you wrote in hosts-dnsmasq

  • After changing hosts-dnsmasq it is not picked up unless you run docker-compose restart
  • After changing dnsmasq.conf, restart with docker-compose restart
    If it is still not picked up, start it with docker-compose down;docker-compose up -d

The contents of dnsmasq.conf

# do not use the default /etc/hosts as DNS records
no-hosts

# ignore /etc/resolv.conf
no-resolv

# do not forward queries for hosts without a domain to the upstream DNS
domain-needed

# do not forward private IP addresses to the upstream DNS
bogus-priv

# local domain setting
local=/local.net/

# automatic domain completion: effective when a domain is set in "domain="
expand-hosts
domain=local.net

# log output and where to store it
log-querie
log-facility=/var/log/dnsmasq/dnsmasq.log

# the number of records dnsmasq caches. setting it to 0 disables caching
cache-size=0

# reverse lookups for 172.17.0.0/24 are sent to 127.0.0.1
server=/0.168.192.in-addr.arpa/127.0.0.1
server=/google.com/8.8.8.8
# anything other than the above is sent to the upstream DNS server
strict-order
# write down the upstream DNS servers. the format is the same as resolv.conf
resolv-file=/etc/dnsmasq.resolv.conf

A caveat

When you configure an upstream DNS, always use a public DNS that supports DNS over HTTPS (DoH)!

References (DNS over TLS, PublicDNS)

docker 
dns