Resolving DNS Troubles at Home: A systemd-resolved and dnsmasq Setup Gone Wrong

Introduction to DNS Troubles

I’ve been running my homelab for years, and one thing that still gets me is DNS troubles. Last year, I decided to set up systemd-resolved and dnsmasq to manage my home network’s DNS. The idea was to use systemd-resolved as the primary resolver and dnsmasq as a caching layer to improve performance. Sounds simple, but it didn’t quite work out that way.

Setting Up systemd-resolved

To start, I enabled systemd-resolved on my Ubuntu-based server. This involved editing the /etc/systemd/resolved.conf file to set the DNS servers and domains. I opted for Cloudflare’s DNS servers - they’re known for being fast and secure.

[Resolve]
DNS=1.1.1.1 1.0.0.1
Domains=~.

Then, I restarted the systemd-resolved service to apply the changes.

sudo systemctl restart systemd-resolved

Don’t bother with this step if you’re using a different distro - the process might be slightly different.

Configuring dnsmasq

Next, I installed and configured dnsmasq to act as a caching layer. I edited the /etc/dnsmasq.conf file to set the upstream DNS servers and enable caching.

server=1.1.1.1
server=1.0.0.1
cache-size=1000

I also configured dnsmasq to listen on the loopback interface and set the DNS port to 53.

listen-address=127.0.0.1
port=53

The real trick is getting these settings just right - too low, and your cache won’t be effective; too high, and you’ll waste memory.

Troubleshooting DNS Issues

After setting up both systemd-resolved and dnsmasq, I started noticing DNS resolution issues. Some domains would resolve slowly or not at all. I used the dig command to troubleshoot the issues.

dig example.com @1.1.1.1

This command queries the example.com domain using Cloudflare’s DNS server. I also used the systemd-resolve command to test DNS resolution.

systemd-resolve example.com

In practice, these commands are essential for figuring out where things are going wrong.

Resolving the Issues

After some trial and error, I discovered that the issue was caused by a misconfiguration in my dnsmasq setup. The caching layer wasn’t properly configured, leading to DNS resolution issues. I updated the dnsmasq configuration to use a larger cache size and enabled the dnssec option to improve security.

cache-size=10000
dnssec

I also ensured that systemd-resolved was configured to use the dnsmasq caching layer.

[Resolve]
DNS=127.0.0.1

This is where people usually get burned - not realizing that systemd-resolved needs to be configured to use the caching layer.

Lessons Learned

I usually start with the basics when troubleshooting DNS issues - checking the configuration files, testing DNS resolution with dig and systemd-resolve. It’s essential to understand how each component works and how they interact with each other. Using a larger cache size and enabling dnssec can significantly improve DNS resolution performance and security.

For more information on systemd-resolved and dnsmasq, I recommend checking out the systemd.io and github.com websites. They provide excellent documentation and resources for configuring and troubleshooting these tools.

Final Thoughts

Resolving DNS troubles at home can be a challenge, but with the right tools and configuration, it’s possible to achieve fast and secure DNS resolution. By using a combination of systemd-resolved and dnsmasq, I was able to improve my home network’s DNS performance and security.