systemd-resolved
systemd-resolved is a systemd service that provides network name resolution to local applications via a D-Bus interface, the resolve
NSS service (nss-resolve(8)), and a local DNS stub listener on 127.0.0.53
. See systemd-resolved(8) for the usage.
Contents
Installation
systemd-resolved is a part of the systemd package that is installed by default.
Configuration
systemd-resolved provides resolver services for Domain Name System (DNS) (including DNSSEC and DNS over TLS), Multicast DNS (mDNS) and Link-Local Multicast Name Resolution (LLMNR).
The resolver can be configured by editing /etc/systemd/resolved.conf
and/or drop-in .conf files in /etc/systemd/resolved.conf.d/
. See resolved.conf(5).
To use systemd-resolved start and enable systemd-resolved.service
.
DNS
systemd-resolved has four different modes for handling the Domain name resolution (the four modes are described in systemd-resolved(8)). We will focus here on the two most relevant modes.
- Using the systemd DNS stub file - the systemd DNS stub file
/run/systemd/resolve/stub-resolv.conf
contains the local stub127.0.0.53
as the only DNS server and a list of search domains. This is the recommended mode of operation. The service users are advised to redirect the/etc/resolv.conf
file to the local stub DNS resolver file/run/systemd/resolve/stub-resolv.conf
managed by systemd-resolved. This propagates the systemd managed configuration to all the clients. This can be done by replacing/etc/resolv.conf
with a symbolic link to the systemd stub:# ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
- Preserving resolv.conf - this mode preserves
/etc/resolv.conf
and systemd-resolved is simply a client of this file. This mode is less disruptive as/etc/resolv.conf
can continue to be managed by other packages.
/etc/resolv.conf
is a symlink to the local stub DNS resolver file or contains server names.Setting DNS servers
$ resolvectl status
Automatically
systemd-resolved will work out of the box with a network manager using /etc/resolv.conf
. No particular configuration is required since systemd-resolved will be detected by following the /etc/resolv.conf
symlink. This is going to be the case with systemd-networkd or NetworkManager.
However, if the DHCP and VPN clients use the resolvconf program to set name servers and search domains (see openresolv#Users for a list of software that use resolvconf), the additional package systemd-resolvconf is needed to provide the /usr/bin/resolvconf
symlink.
Manually
In local DNS stub mode, custom DNS server(s) can be set in the resolved.conf(5) file:
/etc/systemd/resolved.conf.d/dns_servers.conf
[Resolve] DNS=192.168.35.1 fd7b:d0bd:7a6e::1 Domains=~.
Domains=~.
option in resolved.conf(5), systemd-resolved might use the per-link DNS servers, if any of them set Domains=~.
in the per-link configuration. This option will not affect queries of domain names that match the more specific search domains specified in per-link configuration, they will still be resolved using their respective per-link DNS servers.Fallback
If systemd-resolved does not receive DNS server addresses from the network manager and no DNS servers are configured manually then systemd-resolved falls back to the fallback DNS addresses to ensure that DNS resolution always works.
The addresses can be changed by setting FallbackDNS=
in resolved.conf(5). E.g.:
/etc/systemd/resolved.conf.d/fallback_dns.conf
[Resolve] FallbackDNS=127.0.0.1 ::1
To disable the fallback DNS funtionality set the FallbackDNS
option without specifying any addresses:
/etc/systemd/resolved.conf.d/fallback_dns.conf
[Resolve] FallbackDNS=
DNSSEC
By default DNSSEC validation will only be enabled if the upstream DNS server supports it. If you want to always validate DNSSEC, thus breaking DNS resolution with name servers that do not support it, set DNSSEC=true
:
/etc/systemd/resolved.conf.d/dnssec.conf
[Resolve] DNSSEC=true
DNSSEC=false
.Test DNSSEC validation by querying a domain with a invalid signature:
$ resolvectl query sigfail.verteiltesysteme.net
sigfail.verteiltesysteme.net: resolve call failed: DNSSEC validation failed: invalid
Now test a domain with valid signature:
$ resolvectl query sigok.verteiltesysteme.net
sigok.verteiltesysteme.net: 134.91.78.139 -- Information acquired via protocol DNS in 266.3ms. -- Data is authenticated: yes
DNS over TLS
DNS over TLS is disabled by default. To enable it change the DNSOverTLS=
setting in the [Resolve]
section in resolved.conf(5). To enable validation of your DNS provider's server certificate, include their hostname in the DNS=
setting in the format ip_address#hostname
. For example:
/etc/systemd/resolved.conf.d/dns_over_tls.conf
[Resolve] DNS=9.9.9.9#dns.quad9.net DNSOverTLS=yes
ngrep can be used to test if DNS over TLS is working since DNS over TLS always uses port 853 and never port 53. The command ngrep port 53
should produce no output when a hostname is resolved with DNS over TLS and ngrep port 853
should produce encrypted output.
Wireshark can be used for more detailed packet inspection of DNS over TLS queries. It is provided by the wireshark-cli and wireshark-qt packages.
mDNS
systemd-resolved is capable of working as a multicast DNS resolver and responder.
The resolver provides hostname resolution using a "hostname.local" naming scheme.
mDNS will only be activated for the connection if both the systemd-resolved's global setting (MulticastDNS=
in resolved.conf(5)) and the network manager's per-connection setting is enabled. By default systemd-resolved enables mDNS responder, but both systemd-networkd and NetworkManager[1] do not enable it for connections:
- For systemd-networkd the setting is
MulticastDNS=
in the[Network]
section. See systemd.network(5). - For NetworkManager the setting is
mdns=
in the[connection]
section. See nm-settings(5).
avahi-daemon.service
and avahi-daemon.socket
to prevent conflicts with systemd-resolved./etc/NetworkManager/conf.d/
and setting connection.mdns=
in the [connection]
section. See NetworkManager.conf(5).If you plan to use mDNS and use a firewall, make sure to open UDP port 5353
.
LLMNR
Link-Local Multicast Name Resolution is a hostname resolution protocol created by Microsoft.
LLMNR will only be activated for the connection if both the systemd-resolved's global setting (LLMNR=
in resolved.conf(5)) and the network manager's per-connection setting is enabled. By default systemd-resolved enables LLMNR responder; systemd-networkd and NetworkManager[2] enable it for connections.
- For systemd-networkd the setting is
LLMNR=
in the[Network]
section. See systemd.network(5). - For NetworkManager the setting is
llmnr=
in the[connection]
section. See nm-settings(5).
/etc/NetworkManager/conf.d/
and setting connection.llmnr=
in the [connection]
section. See NetworkManager.conf(5).If you plan to use LLMNR and use a firewall, make sure to open UDP and TCP ports 5355
.
Lookup
To query DNS records, mDNS or LLMNR hosts you can use the resolvectl utility.
For example, to query a DNS record:
$ resolvectl query archlinux.org
archlinux.org: 2a01:4f8:172:1d86::1 138.201.81.199 -- Information acquired via protocol DNS in 48.4ms. -- Data is authenticated: no
See resolvectl(1) for more examples.