I implemented this a while back but considerably more efficiently. I wrote a DNS forwarder that adds the resolved IPs to an ipset. The kernel implements this as

I implemented this a while back but considerably more efficiently. I wrote a DNS forwarder that adds the resolved IPs to an ipset. The kernel implements this as a hash table, so lookups are quick. The approach of this project does not scale well. http://git.zx2c4.com/ipset-dns/about/ http://git.zx2c4.com/ipset-dns/about/ I wasn't satisfied with it being standalone and having to forward things to my real resolver, so I went ahead and wrote a patch for DNSMasq that got accepted: http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2013q1/006882.html http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/201... So in your dnsmasq config, just add: ipset=/whatever.com/myipset And then you can do the ordinary matches in iptables to adjust packets as you please, using fwmarks if you need to affect routing. Both tools are included in OpenWRT now as well, if you want to run it on a device.