systemd-resolved

Software that relies on glibc's getaddrinfo(3) (or similar) will work out of the box, since, by default, is configured to use nss-resolve(8) if it is available.

To provide domain name resolution for software that reads directly, such as web browsers and GnuPG, systemd-resolved has four different modes for handling the file—stub, static, uplink and foreign. They are described in . We will focus here only on the recommended mode, i.e. the stub mode which uses .

contains the local stub 127.0.0.53 as the only DNS server and a list of search domains. This is the recommended mode of operation that propagates the systemd-resolved managed configuration to all clients. To use it, replace  with a symbolic link to it:

# ln -rsf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf

systemd-resolved will work out of the box with a network manager using . No particular configuration is required since systemd-resolved will be detected by following the symlink. This is going to be the case with systemd-networkd, NetworkManager, and iwd.

However, if the DHCP and VPN clients use the resolvconf program to set name servers and search domains (see openresolv#Users for a list of software that use resolvconf), the additional package is needed to provide the symlink.

In stub and static modes, custom DNS server(s) can be set in the file:

/etc/systemd/resolved.conf.d/dns_servers.conf

[Resolve]
DNS=192.168.35.1 fd7b:d0bd:7a6e::1
Domains=~.

If systemd-resolved does not receive DNS server addresses from the network manager and no DNS servers are configured manually then systemd-resolved falls back to the fallback DNS addresses to ensure that DNS resolution always works.

The addresses can be changed by setting in . E.g.:

To disable the fallback DNS functionality set the option without specifying any addresses:

DNSSEC validation can be enabled by changing setting in .

• Set to validate DNSSEC only if the upstream DNS server supports it.
• Set to always validate DNSSEC, thus breaking DNS resolution with name servers that do not support it. For example:

/etc/systemd/resolved.conf.d/dnssec.conf

[Resolve]
DNSSEC=true

Test DNSSEC validation by querying a domain with a invalid signature:

Now test a domain with valid signature:

DNS over TLS is disabled by default. To enable it change the setting in the section in . To enable validation of your DNS provider's server certificate, include their hostname in the setting in the format . For example:

can be used to test if DNS over TLS is working since DNS over TLS always uses port 853 and never port 53. The command ngrep port 53 should produce no output when a hostname is resolved with DNS over TLS and  should produce encrypted output.

Wireshark can be used for more detailed packet inspection of DNS over TLS queries.

systemd-resolved is capable of working as a multicast DNS resolver and responder.

The resolver provides hostname resolution using a "hostname.local" naming scheme.

mDNS will only be activated for a connection if both systemd-resolved's mDNS support has been enabled, and if the configuration for the currently active network manager enables mDNS for the connection.

systemd-resolved's mDNS support can be enabled by its MulticastDNS setting (see ).

Enabling per-connection mDNS support depends on the network manager:

• For systemd-networkd, set the MulticastDNS setting in the section of a per-connection settings file. You may also have to set in the section. See .
• Otherwise, for NetworkManager, set in the section of the connection's settings file. Running nmcli connection modify interface_name connection.mdns {yes|no|resolve} will do that for you. See .

Link-Local Multicast Name Resolution is a hostname resolution protocol created by Microsoft.

LLMNR will only be activated for the connection if both the systemd-resolved's global setting (LLMNR in ) and the network manager's per-connection setting is enabled. By default systemd-resolved enables LLMNR responder; systemd-networkd and NetworkManager enable it for connections.

• For systemd-networkd the setting is LLMNR in the section. See .
• For NetworkManager the setting is in the section. See .

If you plan to use LLMNR and use a firewall, make sure to open UDP and TCP ports .

systemd-resolved may not search the local domain when given just the hostname, even when or is present in the appropriate systemd-networkd's .network file, and that file produces the expected in . You can run networkctl status or to check if the search domains are actually being picked up.

Possible workarounds:

• Disable LLMNR to let systemd-resolved immediately continue with appending the DNS suffixes
• Trim 's database (e.g., by removing option after resolve service)
• Switch to using fully-qualified domain names
• Use to resolve hostnames
• Fall back to using glibc's instead of using systemd's resolve

To make systemd-resolved resolve hostnames that are not fully qualified domain names, add ResolveUnicastSingleLabel=yes to .

This only seems to work with LLMNR disabled ().

If you are using systemd-networkd, you might want the domain supplied by the DHCP server or IPv6 Router Advertisement to be used as a search domain. This is disabled by default, to enable it add to the interface's .network file:

You can check what systemd-resolved has for each interface with:

$ resolvectl domain