I have a Debian system that gets its IP from a DHCP server, with my own bind9 server running on localhost. Every time I boot, I have to write nameserver to /etc/resolv.conf, as the system updates the file to match the DNS server assigned by DHCP. To try to prevent resolv.conf from getting updated with DNS server information from my network's DHCP server, I tried writing the following to /etc/network/interfaces:

iface eth0 inet dhcp

but that only works when the system has a static IP.

How can I prevent /etc/resolv.conf from getting overwritten with the DHCP server's assigned DNS server without giving my system a static IP?

I use dhclient.


5 Answers 5


If you are sure you are using dhclient. You can:

1. Change dhclient setting (recommendded)

Edit the file /etc/dhcp/dhclient.conf, search for domain-name-servers, and delete it from the line:

request subnet-mask, broadcast-address, time-offset, routers,
    domain-name, domain-name-servers, domain-search, host-name,
    dhcp6.name-servers, dhcp6.domain-search, dhcp6.fqdn, dhcp6.sntp-servers,
    netbios-name-servers, netbios-scope, interface-mtu,
    rfc3442-classless-static-routes, ntp-servers;

2. Prevent /etc/resolv.conf from being overwritten

Running the following command as root or using sudo so that the file won't get overwritten again:

chattr +i /etc/resolv.conf

It's more or less a duplicated question to Can not set static DNS on debian. But I can't comment so I add this answer.

  • 3
    Please note this should be chattr +i. chattr -i has the opposite effect as what's deccribed here.
    – ollien
    Feb 24, 2019 at 5:31
  • when some other application is installed (network-manager ...) /etc/resolv.conf is a symlink to a file in a tmpfs filesystem, which doesn't support chattr +i .
    – A.B
    Feb 28, 2019 at 14:54
  • 2
    In the dhclient.conf, instead of removing domain-name-servers from the request line, you can add a line with supersede domain-name-servers; below that. This makes it a little easier to maintain because you can comment that line out when you want to go back to the default behavior.
    – ki9
    Apr 11, 2020 at 16:54

You can add:

supersede domain-name-servers;

to /etc/dhcp/dhclient.conf


Remove the resolvconf package and your own /etc/resolv.conf will not be overwritten.

  • 1
    resolvconf already isn't installed on my system; thanks anyway.
    – Billy
    Feb 23, 2017 at 23:44

It depends entirely where your getting your DHCP from.

On my systems (Ubuntu 16.04) I have the "isc-dhcp-server" package installed.

I then switched OFF the DHCP facility in my router/wifi/hub so that the only source of DHCP on my network was my own server.

Once this was done, I then installed "Webmin" and used the browser based tools in that to configure my DHCP server so that it

  • a) Always handed out the DNS server address to DHCP clients that I wanted it to
  • b) Set a specific range of IP addresses to hand out as DHCP for my network
  • c) Set a number of STATIC IP addresses based entirely on the mac address requesting it.

Here's a watered down sample of my /etc/dhcp/dhcpd.conf configuration file

ddns-updates off;
ddns-update-style none;
option time-servers;
option routers;
option domain-name "myinternal.domain.name";
option domain-name-servers;

default-lease-time 1800;
max-lease-time 7200;
log-facility local7;

get-lease-hostnames true;

subnet netmask {
  option time-servers;
  option ntp-servers;
  option domain-search "myinternal.domain.name";
  ddns-updates off;
  option domain-name-servers;
  option domain-name "myinternal.domain.name";
  option routers;
  option broadcast-address;
  default-lease-time 1800;
  max-lease-time 7200;

group {

  use-host-decl-names on;

# Physical lan machines that MUST always have the same IP address

  # DNS Server
  host dnsmachine {
    hardware ethernet 12:12:12:12:12:12; <--- REPLACE THIS WITH THE MACHINES ACTUAL MAC ADDRESS

  # Time server
  host timemachine {
    hardware ethernet 12:12:12:12:12:12; <--- REPLACE THIS WITH THE MACHINES ACTUAL MAC ADDRESS


It assumes you have a class C (24 bit net mask) subnet that allows addresses from to

.0 and .255 are always reserved for broadcast and other special uses, which means your effective range is to

We've set the DNS configuration to use "my.internal.domain.name" as your local domain name. This is YOUR PRIVATE local domain name inside your network, and registered in your own private local DNS.

You don't have to have a network time server, but for added completeness I've added one in along with a DNS server on and respectively

Iv'e set the general (IE: Random) DHCP range to go from to giving you 54 normal DHCP addresses to be handed out as needed, you can increase or decrease this as needed. For example, if you only ever have .2 & .3 as your only fixed addresses, then you could set the start to if you wished.

The lower part of the config defines 2 fixed address machines. These machines identified by their appropriate MAC address will ALWAYS be given the specified fixed IP addresses, this is important for machines acting as servers (Such as DNS) as it always makes sure they can be found at the same address.

Our main config for the random DHCP leases then hands out those very same fixed IP's as the DNS & Time server addresses that will be reported to the clients requesting them.

All you then have to do is set the client machines to get ALL of their details entirely from DHCP, and as long as it's your DHCP service that responds and no other, they will always be assigned the configuration you specify.

  • Great post. I have my own DHCP server on my network, but I travel a lot (this system is a laptop) and I don't want my system querying the shady third-party DNS servers running on public networks. Thanks anyway.
    – Billy
    Feb 24, 2017 at 0:55
  • Well you could do what I do (I travel a lot too) :-) - I have an ubuntu VM running inside virtual box on my lappy. It's an 8 core i7, beast of a thing so I hardly notice that it's there. (Life of a consultant) ;-)
    – shawty
    Feb 24, 2017 at 0:57

edit network file /etc/network/interfaces. and add PEERDNS="no" . This works in Fedora. Hope this work in Debian. You can also use chattr. so that no one can modify the file.

  • 1
    Will not work. The configuration file format is very different. You should consider retracting your answer.
    – AdamKalisz
    Oct 23, 2018 at 22:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .