Arch Linux

Sapiens

Member

Registered: 2021-07-05

Posts: 52

[SOLVED] Did I setup systemd-resolved correctly?

Hello everyone,

I wanted to redirect all DNS queries to the Google DNS severs via DNS over TLS.

I setup systemd-resolved:

# configuring systend-resolved following [url]https://wiki.archlinux.org/title/Systemd-resolved#Configuration[/url]
# configured nameservers in /etc/systemd/resolved.conf
sudo systemctl enable systemd-resolved.service
sudo systemctl start systemd-resolved.service
sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
sudo pacman -S systemd-resolveconf dnsutils
# /etc/NetworkManager/conf.d/dns.conf is now:
# [main]
# dns=systemd-resolved

this leads to dig google.com outputting

; <<>> DiG 9.16.20 <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37507
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;google.com.			IN	A

;; ANSWER SECTION:
google.com.		300	IN	A	173.194.79.102
google.com.		300	IN	A	173.194.79.138
google.com.		300	IN	A	173.194.79.139
google.com.		300	IN	A	173.194.79.101
google.com.		300	IN	A	173.194.79.100
google.com.		300	IN	A	173.194.79.113

;; Query time: 113 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Sat Sep 18 20:07:09 CEST 2021
;; MSG SIZE  rcvd: 135

so the line with server being 127.0.0.53 shows that the query is answered by systemd-resolved server.

However resolvectl status shows:

Global
           Protocols: +LLMNR +mDNS +DNSOverTLS DNSSEC=yes/supported
    resolv.conf mode: stub
  Current DNS Server: 8.8.8.8
         DNS Servers: 8.8.8.8 8.8.4.4
Fallback DNS Servers: 1.1.1.1 9.9.9.9

Link 2 (enp6s0)
    Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6
         Protocols: +DefaultRoute +LLMNR -mDNS +DNSOverTLS DNSSEC=yes/supported
Current DNS Server: fd00::e338:6dff:ef51:1229
       DNS Servers: 192.168.178.1 fd00::e338:6dff:ef51:1229
        DNS Domain: 192.168.178.1

Here it still mentions my ISPs DNS server for the network interface.

How can I make sure Google's DNS server over systemd-resolved is used?

Last edited by Sapiens (2023-01-07 16:57:41)

Koatao

Member

Registered: 2018-08-30

Posts: 113

Re: [SOLVED] Did I setup systemd-resolved correctly?

Hello,
systemd-resolved is tough to grasp...

Per interface DNS servers are, most likely, configured from DHCP options.

Default is to use Global DNS Servers and then only use per interface DNS servers to resolve domain(s) name(s) configured as «DNS Domain» for the specified interface (I think I've read that somewhere in systemd-resolved documentation).

However, I would modify systemd-resolved configuration file (/etc/systemd/resolved) by adding the following line in the [Resolve] section:

Domains=~.

You can capture network trafic with Wireshark or tcpdump if you want actual proof it is working as expected.

EDIT: you can also modify the log-level of systemd-resolved to debug and monitor the logs of the service:

resolvectl log-level debug
journalctl -u systemd-resolved.service -f

Last edited by Koatao (2021-09-18 20:18:41)

Sapiens

Member

Registered: 2021-07-05

Posts: 52

Re: [SOLVED] Did I setup systemd-resolved correctly?

However, I would modify systemd-resolved configuration file (/etc/systemd/resolved) by adding the following line in the [Resolve] section:

Domains=~.

Thank you for mentioning this, it is even suggested in the wiki but I read over it.

EDIT: you can also modify the log-level of systemd-resolved to debug and monitor the logs of the service:

resolvectl log-level debug
journalctl -u systemd-resolved.service -f

This was indeed very helpful! I set it to 'debug' log level and saw it is using the Google DNS as well as DNS over TLS for the request!

If someone else sees this, don't forget to set the log level back to the defaults, when you are done, with:

resolvectl log-level info

I will mark this as solved. Thank you again for the swift and precise answer!

Last edited by Sapiens (2021-09-18 21:58:40)