Introduction to systemd-resolved
I’ve seen this go wrong when working with multi-homed Linux machines: DNS lookup surprises can be a real pain. A multi-homed machine, with multiple network interfaces each connected to a different network, can lead to DNS resolution problems. The system may not know which interface to use for DNS lookups, causing all sorts of issues. This is where people usually get burned - trying to troubleshoot DNS problems without a clear understanding of how their system is configured. To address this issue, I usually start with systemd-resolved, a tool that can help manage DNS resolution and provide more predictable behavior.
Configuring systemd-resolved
To get started with systemd-resolved, you need to ensure it’s installed and enabled on your system. On most Linux distributions, systemd-resolved is installed by default, but it may not be enabled. Don’t bother with manually installing it unless you’re sure it’s not already there - just check the status using the following command:
systemctl status systemd-resolved
If it’s not enabled, you can enable it with:
systemctl enable --now systemd-resolved
Once it’s enabled, you can configure it to use a specific DNS server or set of servers. The real trick is to create a configuration file in the /etc/systemd/resolved.conf.d/ directory. For example, to use Google’s public DNS servers, you can create a file called dns.conf with the following contents:
[Resolve]
DNS=8.8.8.8 8.8.4.4
Then, reload systemd-resolved to apply the new configuration:
systemctl reload systemd-resolved
In practice, this is usually a straightforward process, but I’ve seen cases where the configuration files get messed up, so double-check your work.
Managing DNS Resolution
systemd-resolved provides several options for managing DNS resolution. The resolvectl command is your friend here - you can use it to query the current DNS configuration and perform DNS lookups. For example, to query the current DNS configuration, use:
resolvectl status
This will display the current DNS configuration, including the DNS servers being used and the search domains. I usually start with this command when troubleshooting DNS issues.
Security Considerations
When using systemd-resolved, security is a top concern. One of the most important things to keep in mind is ensuring the DNS servers being used are trustworthy and secure. You can use DNS over TLS (DoT) or DNS over HTTPS (DoH) to encrypt DNS traffic and protect against eavesdropping and tampering. To enable DoT or DoH, add the following lines to your resolved.conf file:
[Resolve]
DNSOverTLS=yes
DNSOverHTTPS=yes
You can find more information about systemd-resolved and its configuration options on the systemd.io website.
Troubleshooting
If you encounter issues with systemd-resolved, there are several troubleshooting steps you can take. The resolvectl command is usually my go-to tool - it can help you query the current DNS configuration and perform DNS lookups. You can also check the systemd-resolved logs to see if there are any error messages that can help you diagnose the issue. For more information on troubleshooting systemd-resolved, refer to the systemd.io website.
See also
- Recovering from a Botched Package Upgrade with apt and snapshotting
- Troubleshooting DNS Leaks with systemd-resolved and resolv.conf
- Extracting Valuable Data from Systemd Journal Logs with jq and grep
- Taming Disk Space Usage with find and xargs in a Busy /var/log Directory
- Taming Disk Space Usage with btrfs Snapshots and Automatic Pruning