title: dnsmasq forwards queries to 2 servers instead of 1
body: <p>I'm having a small issue with dnsmsasq on debian-jessie, it seems to forward incoming DNS queries to 2 ports instead of 1.</p>
  
  <p><strong>Background:</strong></p>
  
  <p>Runs on a machine whose LAN IP is 192.168.0.10. Sits behind a home router. The home router is configured to forward DNS traffic to 192.168.0.10. That part works, I do see incoming traffic from the LAN onto this machine.</p>
  
  <p><strong>dnsmasq configuration:</strong></p>
  
  <pre><code>&gt;cat /etc/dnsmasq.conf | grep -v ^# | grep -v ^\s*$
  
  domain-needed
  bogus-priv
  server=127.0.0.1#5053
  cache-size=10000
  </code></pre>
  
  <p>My <strong>resolv.conf</strong> tells local processes to send DNS queries to dnsmasq</p>
  
  <pre><code>&gt;cat /etc/resolv.conf
  
  # Generated by resolvconf
  nameserver 127.0.0.1
  </code></pre>
  
  <p>And dnsmasq, if it can't answer from its cache, then forwards incoming DNS traffic to another service running locally and listening on port 5053 via the <code>server=127.0.0.1#5053</code> config. That service is something I build myself and it <strong>does not</strong> forward DNS queries to 8.8.8.8</p>
  
  <p>This works but not the way I intended. DNS queries get answered properly. As expected, port 5053 shows traffic and even provides answers (though slower than GoogleDNS)</p>
  
  <pre><code>&gt;tcpdump -l -n -i any '(port 5053) and (port 53)'
  
  13:57:53.817522 IP 127.0.0.1.47207 &gt; 127.0.0.1.53: 7494+ [1au] A? www.example.com. (44)   # dnsmasq receives a query from `dig www.example.com` running locally
  13:57:53.818609 IP 127.0.0.1.5258 &gt; 127.0.0.1.5053: UDP, length 44                        # dnsmasq forwards to local DNS Server listening on 5053
  13:57:53.818970 IP 192.168.0.10.5258 &gt; 8.8.8.8.53: 50849+ [1au] A? www.example.com. (44)  # dnsmasq forwards to 8.8.8.8 on port 53 (Google DNS)
  13:57:53.862170 IP 8.8.8.8.53 &gt; 192.168.0.10.5258: 50849$ 1/0/1 A 93.184.216.34 (60)      # dnsmasq receives answer from 8.8.8.8
  13:57:53.862559 IP 127.0.0.1.53 &gt; 127.0.0.1.47207: 7494 1/0/1 A 93.184.216.34 (60)        # dnsmasq forwards answer to dig running locally
  13:57:53.980238 IP 127.0.0.1.5053 &gt; 127.0.0.1.5258: UDP, length 49                        # dnsmasq receives answer from local DNS Server
  </code></pre>
  
  <p>So it appears dnsmasq tee's DNS queries to both</p>
  
  <ul>
  <li>127.0.0.1 on port 5053, and almost immediately after also forwards to</li>
  <li>8.8.8.8 on port 53</li>
  </ul>
  
  <p>Why, what's wrong with my dnsmasq configuration, I expected traffic only on port 5053?</p>
  
  <p>And where is that 8.8.8.8 coming from. Yes I know that's Google DNS, but where is dnsmasq or linux getting that IP from and which config file can I edit to change that? </p>
  
  <pre><code>&gt;grep -r 8\.8\.8\.8 /etc/*.conf
  </code></pre>
  
  <p>returns nothing. </p>