which dns server is being used by dnsmasq

Question

Is there a way to determine that a DNS server (dnsmasq) is or is not using 8.8.8.8?

I have a Google Nest Wifi Router, and it seems clear (in the diagnostic report[1]) that it is prepending[2] google's 8.8.8.8 and 8.8.4.4 DNS name servers to the name servers assigned in the cable modem's DHCP. Since the Router is using dnsmasq, I believe my queries are effectively using quad-8, regardless of the configuration (which can be one of: Google's, ISP's, or Custom/Manual; set in the Google Wifi app).

Since 8.8.8.8 allegedly does not do IP filtering -- and I do not know if Comcast/Xfinity does IP filtering -- I don't know if it's likely I'll find a hostname that knowingly resolves differently in the two servers. I'm comfortable enough with dig, host, and nslookup to know how to query a particular server (assuming no redirection in the ISP), but I don't know a good way to "know" which server is effectively being used.

I control the zones of two domains (via hostmonster and godaddy). Is there some heuristic to make a zone change and infer which upstream server resolves it? The fact that it will be caching responses makes this a little problematic[3].

(I have not found any dnsmasq configuration files in the diagnostic report, and I don't have ssh access to the Router. I don't currently have an easy mechanism to sniff upstream of the Router, though that might be the only authoritative way. OSes on my private network include win10, mac, and linux, and I have remote access to multiple linux hosts elsewhere.)

My ISP's dns servers are 75.75.75.75 and 75.75.76.76 (if that helps).

Footnotes:

1. Diagnostic report. The Google Nest Wifi Router has several API endpoints for providing instantaneous status (json) and a full diagnostic report (gzipped protobuf). Examples:

   http://testwifi.here/api/v1/status
   http://testwifi.here/api/v1/diagnostic-report
   

2. Prepending. Looking at the diagnostic report, it shows that /etc/resolv.conf lists 8.8.8.8 and 8.8.4.4 first, and one of dhcpcd's parent processes is shill --prepend-dns-servers=8.8.8.8,8.8.4.4. The current configuration is Custom: 75.75.75.75, 75.75.76.76 (primarily for this testing).

3. Caching. I believe there is no mechanism in DNS to disable cached results. https://serverfault.com/q/372066.

Answer 1

This is a "mostly" answer.

TL;DR

OpenDNS is one easy access name server that allows one to have very specific known differences (welcome.opendns.com and internetbadguys.com). That is, navigate to either of those sites on a non-OpenDNS-served connection, and you'll find indications that OpenDNS is not "protecting" you from these two "canaries" (indicators).

Reproducible Steps

... to determine if a router is hijacking your DNS (and you have the belief that you can control the nameservers).

1. Navigate to either or both of the sites. For this example, I'll use internetbadguys.com. This step is a "control"

   

2. Sign up for OpenDNS. This doesn't have to be a permanent condition, and basic services (sufficient for these purposes) are free.

3. Configure your router to use the OpenDNS name servers. For my Google Nest Wifi Router, I needed to use the Google Wifi app (though I think I could have used the Google Home app as well?) (I won't include the advertised IP addresses here: they are well documented, and I don't want a stale answer in case they ever change.)

4. If you're in doubt, you might want or need to include various options of: clearing the browser cache (often Ctrl-Shift-Del) and clearing the local dns cache (windows: ipconfig /flushdns, varies under linux, unsure for macos). You might also need to wait several minutes. (Granted, internetbadguys.com has a TTL of 1, so ... it shouldn't take long, but some name caches might ignore 1.)

Side note: in my case, I verified that the Router's /etc/resolv.conf clearly includes 8.8.8.8 before the opendns nameserver IP addresses. This is what triggered my allegations of DNS hijacking, and checking now it still says this:

nameserver 8.8.8.8
nameserver 8.8.4.4
nameserver <opendns_ip_1>
nameserver <opendns_ip_2>
options single-request timeout:1 attempts:5

5. Navigate yet again to the previous (same) URL. Don't "reload" the page, as it might have been redirected, just go straight to the literal URL. If DNS is being redirected by your Router (or any router between your computer and the OpenDNS nameservers), then you will see the image as above, saying that "InternetBadGuys.com is only a demonstration site". However, if DNS is going as you directed (despite the /etc/resolv.conf also shown above), then you should see something like this:

   

In my case, I believe the Router is not hijacking the DNS for queries on my network, but it is using quad-8s for its internal name-serving.