Taming systemd-resolved: My Journey to Reliable DNS Resolution at Home

Introduction to systemd-resolved

I’ve always been curious about how my Linux system resolves domain names. Recently, I’ve been dealing with some DNS resolution issues at home, which led me to dig into systemd-resolved. As it turns out, many Linux distributions, including Ubuntu and Fedora, use systemd-resolved as their DNS resolver by default. In this article, I’ll share my experience with getting reliable DNS resolution at home using systemd-resolved.

Understanding systemd-resolved

systemd-resolved is part of the systemd suite and provides a DNS resolver service. It’s designed to be a caching, validating, and recursive DNS resolver - which means it can cache DNS responses, validate DNSSEC records, and perform recursive DNS lookups. To check if systemd-resolved is running on your system, you can use the following command:

systemctl status systemd-resolved

If it’s not running, you can start it with:

systemctl start systemd-resolved

I’ve seen this go wrong when the service is not running, so it’s a good idea to check the status before making any changes.

Configuring systemd-resolved

The default configuration of systemd-resolved is usually sufficient, but you may need to customize it to suit your needs. The main configuration file is /etc/systemd/resolved.conf. You can edit this file to change the DNS servers, DNSSEC validation, and other settings. For example, to use Cloudflare’s DNS servers, you can add the following lines to the [Resolve] section:

[Resolve]
DNS=1.1.1.1 1.0.0.1

Don’t bother with restarting your entire system - after making changes to the configuration file, you just need to restart the systemd-resolved service:

systemctl restart systemd-resolved

This is where people usually get burned, so make sure to restart the service to apply your changes.

Troubleshooting DNS Issues

When troubleshooting DNS issues, it’s essential to understand how systemd-resolved works. You can use the resolvectl command to query the DNS resolver and check the status of DNS lookups. For example, to query the IP address of a domain, you can use:

resolvectl query example.com

This command will show you the DNS lookup result, including the IP address and any errors that occurred during the lookup. In practice, this command is super useful for debugging DNS issues.

DNS Over TLS (DoT)

systemd-resolved supports DNS over TLS (DoT), which provides an encrypted connection between your system and the DNS server. To enable DoT, you need to add the DNSOverTLS option to the [Resolve] section of the configuration file:

[Resolve]
DNS=1.1.1.1 1.0.0.1
DNSOverTLS=yes

The real trick is to specify a specific DNS server to use with DoT by adding the DNSOverTLS option to the DNS line:

[Resolve]
DNS=1.1.1.1 1.0.0.1
DNSOverTLS=opportunistic

This will enable DoT for all DNS lookups.

DNSSEC Validation

systemd-resolved also supports DNSSEC validation, which ensures that DNS responses are authentic and have not been tampered with. To enable DNSSEC validation, you need to add the DNSSEC option to the [Resolve] section:

[Resolve]
DNS=1.1.1.1 1.0.0.1
DNSSEC=yes

This will enable DNSSEC validation for all DNS lookups. I usually start with this configuration and then tweak it as needed.

For more information on systemd-resolved, you can visit the systemd.io website, which provides detailed documentation on the systemd suite, including systemd-resolved. You can also check the freedesktop.org website for more information on systemd-resolved.