How to Speed Up DNS Caching on Linux Servers With dnsmasq (2026)

Every time a server sends an email, calls an API, checks a licence or downloads an update, it looks up a domain name in DNS. Without a local cache, each lookup goes over the network to an upstream resolver, adding latency and creating a dependency on that resolver being fast and available. dnsmasq is a lightweight DNS forwarder and cache that keeps recent answers in memory, so repeated lookups are answered almost instantly. This updated 2026 guide shows how to set up dnsmasq DNS caching on modern Linux servers, and when to use alternatives.

Why Cache DNS on a Server?

• Faster responses: cached lookups return in well under a millisecond instead of tens of milliseconds.
• Resilience: brief upstream resolver problems affect you less.
• Less load: busy mail servers, scrapers and application servers make thousands of lookups. A cache cuts that traffic dramatically.
• Control: choose your upstream resolvers and add local overrides.

dnsmasq vs systemd-resolved vs Unbound

• systemd-resolved: already enabled on Ubuntu and some other distributions, with a built-in cache on 127.0.0.53. For many servers it is enough.
• dnsmasq: tiny, simple to configure, with a large configurable cache, local host overrides and optional DHCP. Great for app servers, VPNs and small networks.
• Unbound: a full validating recursive resolver with DNSSEC. Better if you want to resolve directly from root servers or need advanced features.

Before You Start: Check What Uses Port 53

Only one service can listen on a given address and port 53. Check first:

sudo ss -lntup | grep ':53 '

• On Ubuntu, systemd-resolved’s stub listener uses 127.0.0.53. You can disable the stub (set DNSStubListener=no in /etc/systemd/resolved.conf) or bind dnsmasq to 127.0.0.1 only.
• On cPanel, Plesk or DNS servers running BIND or PowerDNS, those services already use port 53. Don’t add dnsmasq without careful planning, or you may break authoritative DNS for your customers.

Step 1: Install dnsmasq

AlmaLinux / Rocky Linux / RHEL: sudo dnf install dnsmasq

Ubuntu / Debian: sudo apt install dnsmasq

Step 2: Configure It as a Local Cache

Create /etc/dnsmasq.d/cache.conf with:

• listen-address=127.0.0.1: answer only local queries.
• bind-interfaces: bind only to that address, avoiding conflicts.
• cache-size=10000: keep up to 10,000 records in memory.
• no-resolv: don’t read upstream servers from /etc/resolv.conf.
• server=1.1.1.1 and server=9.9.9.9: your upstream resolvers. Use your provider’s or your own if you prefer.
• domain-needed and bogus-priv: don’t forward incomplete names or private reverse lookups.

Step 3: Point the Server at dnsmasq

Set the system resolver to 127.0.0.1. On systems using NetworkManager, configure DNS on the connection (for example nmcli con mod eth0 ipv4.dns 127.0.0.1 ipv4.ignore-auto-dns yes). On others, update /etc/resolv.conf and make sure it isn’t overwritten by DHCP or cloud-init.

Step 4: Start and Test

1. sudo systemctl enable --now dnsmasq
2. Run dig example.com @127.0.0.1 twice. The second query should show a query time of 0 ms or close to it.
3. Check logs with journalctl -u dnsmasq if anything fails.

Security Tips

• Never expose dnsmasq to the internet. An open resolver can be abused for DDoS amplification. Keep it on 127.0.0.1 or a private interface, and block port 53 from outside in your firewall.
• Choose trustworthy upstream resolvers, and consider DNS-over-TLS through a local stub if privacy matters.
• Keep the package updated with normal OS patching. See our Linux server hardening checklist.

Frequently Asked Questions

Does dnsmasq make websites faster?

It speeds up DNS lookups made by the server, such as outgoing API calls, mail delivery and updates. It doesn’t change how fast visitors’ browsers resolve your domain.

Is systemd-resolved enough?

For many servers, yes. dnsmasq is useful when you want a larger cache, simple local overrides, or a setup that behaves the same across different distributions.

Can dnsmasq run on a cPanel server?

Usually not alongside cPanel’s own DNS service on port 53. On cPanel servers, tune the existing resolver configuration instead, or ask an experienced administrator.

How VIPoint Can Help

VIPoint Solutions has managed Linux servers since 2012. Our engineers in Infopark, Kochi handle DNS, mail, web and database tuning on more than 10,000 servers, and provide 24/7 monitoring and cPanel server management.