Troubleshooting DNS Leaks with systemd-resolved and resolv.conf -

Introduction to DNS Leaks

I’ve seen DNS leaks become a major concern for Linux users, especially those relying on systemd-resolved. A DNS leak occurs when your system sends DNS queries to an unintended DNS server, potentially exposing your browsing history and other sensitive information. In this article, I’ll share my experience and insights on how to identify and troubleshoot DNS leaks using systemd-resolved and resolv.conf.

Understanding systemd-resolved

Systemd-resolved is a powerful tool that provides DNS resolution. It acts as a local DNS resolver, caching DNS queries and responses to improve performance. By default, systemd-resolved uses the DNS servers provided by your network configuration, but you can configure it to use specific DNS servers. To check the current DNS servers used by systemd-resolved, run:

resolvectl status

This command will display the current DNS servers, as well as other information about your DNS configuration. Don’t bother with trying to parse the output manually - just look for the Current DNS Server section.

Understanding resolv.conf

Resolv.conf is a configuration file that contains the DNS servers used by your system. When using systemd-resolved, this file is typically managed by systemd-resolved itself. However, you can still edit it manually to specify custom DNS servers. To do so, use your preferred text editor:

sudo nano /etc/resolv.conf

Be cautious when editing resolv.conf, as incorrect changes can cause DNS resolution issues. I usually start with a backup of the original file, just in case.

Identifying DNS Leaks

To identify DNS leaks, I recommend using online tools like dnsleaktest.com. These tools will perform a series of DNS queries and display the DNS servers that responded. If you see DNS servers that you didn’t configure, it may indicate a DNS leak. Alternatively, you can use the tcpdump command to capture DNS traffic and analyze it:

sudo tcpdump -i any -n -vv -s 0 -c 100 -W 100 port 53

This command will capture 100 DNS packets and display them in a verbose format. The real trick is to filter out the noise and focus on the DNS servers that are responding.

Troubleshooting DNS Leaks

Troubleshooting DNS leaks can be a challenge, but it’s essential to identify the source of the leak. Here are some common causes:

Incorrect DNS server configuration: Make sure that your DNS servers are correctly configured in resolv.conf and systemd-resolved.
VPN configuration: If you’re using a VPN, ensure that it’s properly configured to use the VPN’s DNS servers.
Network configuration: Check your network configuration to ensure that it’s not sending DNS queries to an unintended DNS server.

To fix a DNS leak, you can try the following:

Use a VPN with built-in DNS leak protection: Many VPNs offer built-in DNS leak protection, which can help prevent DNS leaks.
Configure systemd-resolved to use specific DNS servers: You can configure systemd-resolved to use specific DNS servers, such as those provided by your VPN or a third-party DNS service.
Use a DNS proxy: A DNS proxy can help prevent DNS leaks by intercepting DNS queries and forwarding them to a specified DNS server.

Configuring systemd-resolved for Privacy

To configure systemd-resolved for maximum privacy, I recommend using the following settings:

[Resolve]
DNS=87.236.94.100 5.9.164.174
FallbackDNS=1.1.1.1 8.8.8.8
Domains=~

These settings configure systemd-resolved to use the DNS servers provided by dns.watch and ibahn.id as the primary DNS servers, with Cloudflare and Google as fallback DNS servers. In practice, this setup provides a good balance between performance and privacy.

Final Thoughts

Troubleshooting DNS leaks with systemd-resolved and resolv.conf requires a combination of understanding how DNS resolution works and using the right tools to identify and fix issues. By using a VPN with built-in DNS leak protection, configuring systemd-resolved to use specific DNS servers, and using a DNS proxy, you can help prevent DNS leaks and maintain your online privacy.

For more information on systemd-resolved, you can visit the systemd.io website. For information on resolv.conf, you can refer to the man pages.