Correct. And it would be a problem if something was listening on 80/443/whatever. That's why '--dest-ip' can be set. from man dnsmasq: -B, --bogus-nxdomain=

Correct. And it would be a problem if something was listening on 80/443/whatever. That's why '--dest-ip' can be set. from man dnsmasq: -B, --bogus-nxdomain=<ipaddr> Transform replies which contain the IP address given into "No such domain" replies. This is intended to counteract a devious move made by Verisign in September 2003 when they started returning the address of an advertising web page in response to queries for unregistered names, instead of the correct NXDOMAIN response. This option tells dnsmasq to fake the correct response when it sees this behaviour. As at Sept 2003 the IP address being returned by Verisign is 64.94.110.11 Is there another way to get dnsmasq to return NXDOMAIN? If I am reading this correctly, one would need to do 'dnsgate --dest-ip 127.2.2.2' and then tell dnsmasq '--bogus-nxdomain=127.2.2.2'.