{"id":18601959,"url":"https://github.com/coonrad/macos-dns-sinkhole","last_synced_at":"2025-05-16T17:34:20.514Z","repository":{"id":246485448,"uuid":"821249902","full_name":"coonrad/macOS-DNS-sinkhole","owner":"coonrad","description":"Use dnsmasq on macOS to sinkhole DNS traffic to specified domains.","archived":false,"fork":false,"pushed_at":"2024-06-28T07:20:16.000Z","size":5,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-02-18T01:37:24.852Z","etag":null,"topics":["dns","dnsmasq","macos","sinkhole"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/coonrad.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-06-28T06:13:54.000Z","updated_at":"2024-06-28T07:20:20.000Z","dependencies_parsed_at":"2024-06-28T08:55:23.908Z","dependency_job_id":null,"html_url":"https://github.com/coonrad/macOS-DNS-sinkhole","commit_stats":null,"previous_names":["coonrad/macos-dns-sinkhole"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coonrad%2FmacOS-DNS-sinkhole","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coonrad%2FmacOS-DNS-sinkhole/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coonrad%2FmacOS-DNS-sinkhole/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coonrad%2FmacOS-DNS-sinkhole/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/coonrad","download_url":"https://codeload.github.com/coonrad/macOS-DNS-sinkhole/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254576748,"owners_count":22094447,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dns","dnsmasq","macos","sinkhole"],"created_at":"2024-11-07T02:09:50.656Z","updated_at":"2025-05-16T17:34:20.476Z","avatar_url":"https://github.com/coonrad.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# macOS-DNS-sinkhole\nUse dnsmasq on macOS to sinkhole DNS traffic to specified domains.\n\nThis configuration has some limitations to a standard deployment of dnsmasq. The only DNS traffic directed to dnsmasq are the domains matched in `/etc/resolver`. There doesn't seem to be a simple or easy solution to direct all DNS traffic to dnsmasq in macOS. Despite this limitation it is very easy and useful to be able to block DNS to any specified domains.\n\n## Setup\n\nInstall dnsmasq:\n\n```bash\n# Macports\nport install dnsmasq\n# Homebrew\nbrew install dnsmasq\n```\n\nThis configuration uses paths for Macports. Adjust your config accordingly for Homebrew.\n\nCreate directories.\n\n```bas\nsudo mkdir /opt/local/etc/dnsmasq/\nsudo mkdir /etc/resolver\n```\n\nEdit `/opt/local/etc/dnsmasq.conf`.\n\n```bash\nrebind-localhost-ok\nstop-dns-rebind\nstrict-order\ndomain-needed\nbogus-priv\nno-hosts\ndns-forward-max=5000\ncache-size=10000\nlog-queries\nlog-facility=/var/log/resolver.log\n\nlisten-address=127.0.0.1\n\nconf-file=/opt/local/etc/dnsmasq/domains\n```\n\nEdit `/opt/local/etc/dnsmasq/domains`\n\n```bash\n# custom domain block list\n# each domain must have a matching record in /etc/resolver\n\n# facebook\nlocal=/facebook.com/\nlocal=/facebook.net/\nlocal=/fb.com/\n```\n\nCreate `/etc/resolver/` files for each domain.\n\n```bash\nprintf \"nameserver 127.0.0.1\" | sudo tee /etc/resolver/facebook.com\nprintf \"nameserver 127.0.0.1\" | sudo tee /etc/resolver/facebook.net\nprintf \"nameserver 127.0.0.1\" | sudo tee /etc/resolver/fb.com\n```\n\nLoad dnsmasq.\n\n```bash\nsudo port load dnsmasq\n```\n\nAt this point dnsmasq is configured to listen on `127.0.0.1`. Any traffic for the domains in `/etc/resolver` will be directed to dnsmasq. This will result in `NXDOMAIN` and traffic to the specified domain will not resolve. You can verify this by doing `host` or `dig` commands against `127.0.0.1` or viewing the resolver log. (If you don't want to log queries to dnsmasq. Comment out `log-facilty` in the configuration file.)\n\n```bash\nJun 27 23:59:33 dnsmasq[89]: query[A] facebook.com from 127.0.0.1\nJun 27 23:59:33 dnsmasq[89]: config facebook.com is NXDOMAIN\n```\n\nWith some automation you should be able to block hundreds or thousands of domains. For instance this bash function will grep the domains from the domains file and populate an entry for each one to `/etc/resolver`.\n\n```bash\nfunction dnsmasq_setup() {\n\n    # grep list of domains for /etc/resolver\n    domains=$(grep -o -P '(?\u003c=/).*(?=/)' /opt/local/etc/dnsmasq/domains)\n\n    # create /etc/resolver file for each domain\n    for i in $domains; do\n        echo \"nameserver 127.0.0.1\" | sudo tee /etc/resolver/\"$i\" \u003e/dev/null\n    done\n\n    # restart dnsmasq\n    sudo port reload dnsmasq\n}\n```\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcoonrad%2Fmacos-dns-sinkhole","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcoonrad%2Fmacos-dns-sinkhole","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcoonrad%2Fmacos-dns-sinkhole/lists"}