0

I would like my newer GNU/Linux system (Ubuntu 18.04 LTS) to use a single, manually-configured, DNS server for all DNS queries. In the past, I could simply do echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.conf to clobber the /etc/resolv.conf file and persistently set the DNS server's IP address for my entire system.

On this (and many newer GNU/Linux distributions), /etc/resolv.conf is managed by the resolvconf(8) utilties. On Ubuntu 18.04, this file contains a line like this:

nameserver 127.0.0.53

As can see by sudo ss --listening --numeric --processes, the local system's systemd-resolved DNS stub resolver is bound to this IP address and is listening on port 53 for incoming DNS requests. Therefore, the above nameserver line in the /etc/resolv.conf file is directing all applications that do not use systemd-resolved's D-Bus or glibc API to the systemd-resolved service via "normal" DNS requests.

That's all fine and well, but all this means that I can no longer simply write persistent changes to the /etc/resolv.conf file in order to effect a nameserver change.

After reading numerous manual pages and blog posts, I learned that I could set "global" DNS nameserver IP address(es) by editing, for example, the /etc/systemd/resolve.conf file such that this file contained a line as follows:

DNS=1.1.1.1 9.9.9.9

After making this change and invoking sudo systemctl restart systemd-resolved, running systemd-resolve --status did show the new nameservers (1.1.1.1 and 9.9.9.9) in the "Global" section. However, a Wireshark packet capture confirmed that my system was still sending DNS queries to the "per-link" DNS server presumably configured via DHCP (say, 192.168.1.1).

Further experimentation lead me to add the following line to my /etc/systemd/resolve.conf file:

Domains=~.

This seems to have successfully instructed systemd-resolved to always use the global nameservers (set in the DNS= option) and to never query any DHCP-supplied nameservers, even though those nameservers still show up when I inspect the output of systemd-resolve --status.

Finally my questions: Aside from the obvious impact this will have on, say, ignoring VPN-supplied DNS information, what other potential impact will this have on my system? And, more importantly, is there a recommended way to completely override dynamically-configured nameserver settings, such as those provided by DHCP, on a system using systemd-resolved such as Ubuntu 18.04 that is more complete than simply editing each NetworkManager-managed connection via the GUI? In particular, I do not want to have to edit the DNS settings for each individual Wi-Fi network that I join; I want all connections to automatically always use statically-configured nameservers for DNS resolution. What is the "best" way to do that, and why?

Thank you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.