Taming systemd-resolved: My Journey to Fixing DNS Leaks and Annoying resolver Errors on My Linux Desktop

Introduction to systemd-resolved

I’ve spent years working with Linux, and one component that’s given me trouble is systemd-resolved, the DNS resolver service that comes bundled with systemd. Recently, I noticed my DNS queries were leaking, and I was getting annoying resolver errors on my Linux desktop. This prompted me to dive deeper into systemd-resolved and figure out how to tame it. I’ve seen this go wrong when people don’t take the time to understand how it works, so let’s start with the basics.

Understanding systemd-resolved

systemd-resolved is a DNS resolver service that provides a simple and efficient way to resolve domain names. It’s designed to work seamlessly with systemd, the init system used by many Linux distributions. By default, systemd-resolved uses a combination of DNS resolvers, including the ones specified in /etc/resolv.conf and the ones provided by your network manager. Don’t bother with trying to edit /etc/resolv.conf directly, though - systemd-resolved will just override your changes.

To get a better understanding of how systemd-resolved works, you can use the resolvectl command. For example, to see the current DNS resolvers in use, you can run:

resolvectl status

This will show you the current DNS resolvers, as well as the DNSSEC validation status. In practice, this command is super useful for troubleshooting DNS issues.

Fixing DNS Leaks

One of the issues I encountered with systemd-resolved was DNS leaks. A DNS leak occurs when your system sends DNS queries to an unauthorized DNS server, potentially revealing your browsing history and other sensitive information. This is where people usually get burned - they don’t realize their DNS queries are leaking, and it can be a real security risk. To fix DNS leaks, you can configure systemd-resolved to use a specific DNS resolver, such as a VPN-provided DNS server or a secure DNS service like Cloudflare’s 1.1.1.1.

To configure systemd-resolved to use a specific DNS resolver, you can create a drop-in configuration file in /etc/systemd/resolved.conf.d/. For example, to use Cloudflare’s 1.1.1.1 DNS server, you can create a file called cloudflare.conf with the following contents:

[Resolve]
DNS=1.1.1.1 1.0.0.1

Then, reload the systemd-resolved service to apply the changes:

sudo systemctl reload systemd-resolved

I usually start with a simple configuration like this and then tweak it as needed.

Troubleshooting Resolver Errors

Another issue I encountered with systemd-resolved was resolver errors. These errors can occur when systemd-resolved is unable to resolve a domain name, often due to a misconfigured DNS resolver or a network issue. The real trick is to use the resolvectl command to query the DNS resolver directly. For example, to query the DNS resolver for the domain example.com, you can run:

resolvectl query example.com

This will show you the response from the DNS resolver, including any error messages.

Configuring DNSSEC Validation

DNSSEC (Domain Name System Security Extensions) is a security protocol that provides authentication and integrity of DNS data. systemd-resolved supports DNSSEC validation, which can help prevent DNS spoofing attacks. To configure DNSSEC validation, you can add the following line to your resolved.conf file:

DNSSEC=yes