3

I am using the latest Raspbian Lite Linux and I cannot figure out how to get it to tell me which DNS server my queries are being sent to. Everything that I try is only returning the localhost address (127.0.0.1), which of course is referring to the local DNS cache. However, I want to know which upstream DNS server is being used (in my case, I want to verify that it is using the Google DNS servers, not the router).

Here's are some details:

  • reslovconf is installed.
  • I have not set any custom DNS servers in /etc/resolvconf.conf.
  • The contents of /etc/resolv.conf are automatically generated by resolvconf. It contains the line nameserver 127.0.0.1. Manual changes to this file do not persist (as expected).
  • In /etc/network/interfaces I have the following line in my network interface settings for wlan0: dns-nameservers 8.8.8.8 8.8.4.4

What I have tried:

  • dig returns SERVER: 127.0.0.1#53(127.0.0.1)
  • nslookup returns Server: 127.0.0.1 Address: 127.0.0.1#53
  • cat /etc/resolv.conf returns nameserver 127.0.0.1
  • nmcli dev show | grep DNS returns no results. There are no DNS related entries at all in a full nmcli dev show.

Any recommendations beyond what I've tried so far?

For clarity: DNS is working fine. I just want to know what upstream server is being queried.

  • What does tcpdump or wireshark show going on for DNS packets? – thrig Jan 11 '17 at 19:03
  • @thrig I don't know why I hadn't thought about using packet capture. I guess I was too stuck on finding a command to spit out a the response I wanted to think about all the options. I'll give it a shot and let you know, though I expect that you've answered my question. – blendenzo Jan 11 '17 at 19:09
  • 2
    Sounds like you have a DNS resolver installed. Usual ones being bind9 (named), dnsmasq or unbound. Check your ps ax for a process matching these names, then look for the corresponding configuration files, ... – SYN Jan 11 '17 at 19:15
  • @SYN you are correct. This particular Raspberry Pi is wifi-sharing device, and I installed dnsmasq as part of the initial configuration a few months ago, but I had entirely forgotten about that. Running service dnsmasq status revealed the info I was looking for. Would you mind making your comment into an answer so that I can accept it? – blendenzo Jan 11 '17 at 19:26
  • Packet capture is probably a bit premature at this point. Since you can see the requests going to udp/53 on localhost, you can just check netstat -tlpn or lsof -i udp:53 for what program is listening on that port and then look at its configuration to see what upstream servers it has configured. It would be more complete as well since a capture would just get the servers it happened to go out to that one time. – Bratchley Jan 11 '17 at 20:10
2

As discussed in comments, sounds like you have a DNS resolver installed. Usual ones being bind9 (named), dnsmasq or unbound.

Check your ps ax for a process matching these names, then look for the corresponding configuration files.

  • Repeating what I said above in the comments: I had installed dnsmasq a few months ago and forgotten about it. By running service dnsmasq status I was able to see the upstream DNS servers being used. – blendenzo Jan 12 '17 at 1:06
-1

You probably using dnsmasq , try running

ps -ef | grep dnsmasq

This should give you the config file for dnsmasq which used, then just look into it and see which DNS are used as forwards for dnsmasq.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.