diff --git a/qa/tasks/dnsmasq.py b/qa/tasks/dnsmasq.py
index 4e44c8aa74d..9b615ccadc6 100644
--- a/qa/tasks/dnsmasq.py
+++ b/qa/tasks/dnsmasq.py
@@ -31,12 +31,18 @@ def install_dnsmasq(remote):
             packaging.remove_package('dnsmasq', remote)
 
 @contextlib.contextmanager
-def configure_dnsmasq(remote, path, cnames):
+def configure_dnsmasq(remote, path, cnames, no_resolv=False):
     """
     configure dnsmasq on the given remote, adding each cname given
+
+    When no_resolv is set, dnsmasq will not forward unmatched queries upstream
+    via /etc/resolv.conf. This is needed on the systemd-resolved path: resolved
+    routes the cname domains to dnsmasq, but /etc/resolv.conf points back at
+    resolved, so forwarding would form a query loop that stalls resolution.
     """
-    data = """# This file is generated by dnsmasq teuthology task
-"""
+    data = "# This file is generated by dnsmasq teuthology task\n"
+    if no_resolv:
+        data += "no-resolv\n"
     for cname, ip_address in cnames.items():
         data += f"address=/.{cname}/{ip_address}\n"
 
@@ -171,7 +177,8 @@ def task(ctx, config):
             subtasks.extend([ lambda r=remote: configure_network_manager(r) ])
         else:
             path = '/etc/dnsmasq.d/ceph.conf'
-            subtasks.extend([ lambda r=remote, p=path, cn=cnames: configure_dnsmasq(r, p, cn) ])
+            # no_resolv avoids a resolv.conf <-> resolved query loop, see configure_dnsmasq() docstring
+            subtasks.extend([ lambda r=remote, p=path, cn=cnames: configure_dnsmasq(r, p, cn, no_resolv=True) ])
             subtasks.extend([ lambda r=remote, cn=cnames: configure_systemd_resolved(r, cn) ])
         subtasks.extend([ lambda r=remote, cn=cnames: test_dns_names(r, cn) ])