We have to use 'hex-string' because the packet doesn't actually contain any real dots. The 'u32' part ensures that the packet is actually a DNS query ( source), the 'icase' makes the string matching case insensitive, the 'from' part just skips ahead to the earliest part of the packet where the string could actually be matched, and then finally we're dropping the packet if the string does NOT match ''. Using the PREROUTING chain catches the packet as soon as it hits the Docker host. I had to use the PREROUTING chain and a destination IP address, because adding this rule to the FORWARD chain without a destination IP address prevents containers being able to resolve external domains, and by the time the packet hits the FORWARD chain, the destination IP address could be anything. I found that this works pretty nicely for a single domain, where n.n.n.n is my Docker host's IP address: iptables -A PREROUTING -t raw -d n.n.n.n -p udp -dport 53 -m u32 -u32 '28 & 0xF8 = 0' -m string -algo bm -icase -from 40 ! -hex-string '|08|mydomain|03|com' -j DROP Maybe a bit off-topic for the feature request, but as far as blocking unwanted DNS queries with iptables is concerned, it would seem preferable to simply block all queries that don't match the domain your acme-dns instance is serving, rather than trying to block specific spam queries like 'pizzaseo'.

Rcode nxdomain