21

For configuring custom DNS servers in a brand new Kubuntu 19.10 laptop it wasn't enough with adding to /etc/systemd/resolved.conf:

DNS=77.88.8.7 77.88.8.3 #Yandex's DNS with no porn even on Google Images

I also had to change the symlink of /etc/resolv.conf

$ ls -l /etc/resolv.conf 
lrwxrwxrwx 1 root root 37 oct 26 01:48 /etc/resolv.conf -> /run/systemd/resolve/stub-resolv.conf
$ sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

/run/systemd/resolve/stub-resolv.conf only has the ISP's given DNSs, while the custom DNSs are only in /run/systemd/resolve/resolv.conf.

When looking at:

man systemd-resolved.service

it says that the recommended file is /run/systemd/resolve/stub-resolv.conf, but I don't get their differences (that understandable and simple explanation should be the accepted answer). If so, how could I set the system to use the globally configured DNSs using that file and not the other?

Note: On laptop, with plenty of WiFi connections, it's not viable to configure a per-connection DNS, like suggested in many sites that says how to achieve this I just described

Additional info for curious:

/run/systemd/resolve/$ diff stub-resolv.conf resolv.conf 
3,8c3,4
< # This is a dynamic resolv.conf file for connecting local clients to the
< # internal DNS stub resolver of systemd-resolved. This file lists all
< # configured search domains.
< #
< # Run "resolvectl status" to see details about the uplink DNS servers
< # currently in use.
---
> # This is a dynamic resolv.conf file for connecting local clients directly to
> # all known uplink DNS servers. This file lists all configured search domains.
17,18c13,17
< nameserver 127.0.0.53
< options edns0
---
> nameserver 77.88.8.7
> nameserver 77.88.8.3
> nameserver 200.49.130.40
> # Too many DNS servers configured, the following entries may be ignored.
> nameserver 200.42.4.207

1 Answer 1

8

Using resolv.conf instead of stub-resolv.conf will bypass a lot of systemd-resolved configuration, such as DNS answer caching, per-interface DNS configuration, DNSSec enforcement, etc.

Explanations:

When using stub-resolv.conf, applications will make DNS requests to the DNS stub resolver provided by systemd on address 127.0.0.53. This stub resolver will proxy the DNS requests to the upstream DNS resolvers configured in systemd-resolved, applying whatever logic it wants to those requests and answers, like caching them.

When using resolv.conf, applications will directly make DNS requests to the "real" (aka. upstream) DNS resolvers configured in systemd-resolved. In this case, systemd-resolved only acts as a "resolv.conf manager", not as a DNS resolver itself.

Source: systemd-resolved manpage

1
  • 1
    Well good riddance to the systemd-resolved configuration, as it seems to cause nothing but grief in our installations. I constantly have to restart the systemd-resolved service to get it to pick up the configuration in /etc/systemd/resolved.conf. Every time I reboot one of our servers I have to check if the stub resolver came up properly. Mar 29, 2021 at 23:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.