Domain name resolution: Difference between revisions
m (Larivact moved page Resolv.conf to Domain name resolution: move as discussed in Talk:Domain name resolution#Rewrite) |
m (→Check if you can resolve domain names: rm #Glibc resolver link from Note as the section doesn't describe the issue) |
||
(72 intermediate revisions by 2 users not shown) | |||
Line 1: | Line 1: | ||
[[Category:Domain Name System]] | [[Category:Domain Name System]] | ||
[[Category:Network configuration]] | [[Category:Network configuration]] | ||
Line 9: | Line 8: | ||
[[zh-hans:Resolv.conf]] | [[zh-hans:Resolv.conf]] | ||
{{Related articles start}} | {{Related articles start}} | ||
{{Related| | {{Related|Alternative DNS services}} | ||
{{Related|Network configuration}} | |||
{{Related articles end}} | {{Related articles end}} | ||
This article explains how to configure [[Wikipedia:Domain name|domain name]] resolution and resolve domain names. | |||
== Name Service Switch == | |||
: | :''"NSS" redirects here. For Mozilla cryptographic libraries, see [[Network Security Services]].'' | ||
: | The [[Wikipedia:Name Service Switch|Name Service Switch]] (NSS) facility is part of the GNU C Library ({{Pkg|glibc}}) and backs the {{man|3|getaddrinfo}} API, used to resolve domain names. NSS allows system databases to be provided by separate services, whose search order can be configured by the administrator in {{man|5|nsswitch.conf}}. The database responsible for domain name resolution is the {{ic|hosts}} database, for which glibc offers the following services: | ||
* {{ic|file}}: reads the {{ic|/etc/hosts}} file, see {{man|5|hosts}} | |||
* {{ic|dns}}: the [[#Glibc resolver|glibc resolver]] which reads {{ic|/etc/resolv.conf}}, see {{man|5|resolv.conf}} | |||
[[Systemd]] provides three NSS services for hostname resolution: | |||
{{ | * {{man|8|nss-resolve}} - a caching DNS stub resolver, described in [[#Systemd-resolved]] | ||
* {{man|8|nss-myhostname}} - provides hostname resolution without having to edit {{ic|/etc/hosts}}, described in [[Network configuration#Local hostname resolution]] | |||
* {{man|8|nss-mymachines}} - provides hostname resolution for the names of local {{man|8|systemd-machined}} containers | |||
== | === Check if you can resolve domain names === | ||
NSS databases can be queried with {{man|1|getent}}. You can resolve a domain name through NSS using: | |||
$ getent hosts ''domain_name'' | |||
{{Note|While most programs resolve domain names using NSS, some may read {{ic|resolv.conf}} and/or {{ic|/etc/hosts}} directly. See [[Network configuration#Local hostname resolution]].}} | |||
== Glibc resolver == | |||
The glibc [[wikipedia:Domain_Name_System|DNS]] resolver reads {{ic|/etc/resolv.conf}} ({{man|5|resolv.conf}}) for every resolution to determine the nameservers and options to use. | |||
Nameservers listed first are tried first, up to three nameservers may be listed. Lines starting with a number sign are ignored. | |||
{{Note|The glibc resolver does not cache queries. See [[#Performance]] for more information.}} | |||
=== Overwriting of resolv.conf === | |||
[[Network manager]]s tend to overwrite {{ic|resolv.conf}}, for specifics see the corresponding section: | |||
* [[dhcpcd#resolv.conf]] | |||
* [[netctl#resolv.conf]] | |||
* [[NetworkManager#resolv.conf]] | |||
To prevent programs from overwriting {{ic|resolv.conf}} you can also write-protect it by setting the immutable [[file attribute]]. | |||
{{Tip|If you want multiple processes to write to {{ic|resolv.conf}}, you can use [[openresolv]].}} | |||
{{Tip| | |||
=== Limit lookup time === | === Limit lookup time === | ||
Line 153: | Line 76: | ||
That way you can refer to local hosts such as {{ic|mainmachine1.example.com}} as simply {{ic|mainmachine1}} when using the ''ssh'' command, but the ''drill'' command still requires the fully qualified domain names in order to perform lookups. | That way you can refer to local hosts such as {{ic|mainmachine1.example.com}} as simply {{ic|mainmachine1}} when using the ''ssh'' command, but the ''drill'' command still requires the fully qualified domain names in order to perform lookups. | ||
== | == Systemd-resolved == | ||
{{man|8|systemd-resolved}} is a [[systemd]] service that provides network name resolution to local applications via a [[D-Bus]] interface, the {{ic|resolve}} NSS service ({{man|8|nss-resolve}}), and a local DNS stub listener on {{ic|127.0.0.53}}. | |||
[ | ''systemd-resolved'' has four different modes for handling the [[#Glibc resolver|glibc resolver]]'s ''resolv.conf'' (described in {{man|8|systemd-resolved|/ETC/RESOLV.CONF}}). We will focus here on the two most relevant modes. | ||
# The mode in which ''systemd-resolved'' is a client of the {{ic|/etc/resolv.conf}}. This mode preserves {{ic|/etc/resolv.conf}} and is '''compatible''' with the procedures described in this page. | |||
# The ''systemd-resolved'''s '''recommended''' mode of operation: the DNS stub file as indicated below contains both the local stub {{ic|127.0.0.53}} as the only DNS servers and a list of search domains. | |||
{{hc|/run/systemd/resolve/stub-resolv.conf| | |||
nameserver 127.0.0.53 | |||
search lan | |||
}} | |||
The service users are advised to redirect the {{ic|/etc/resolv.conf}} file to the local stub DNS resolver file {{ic|/run/systemd/resolve/stub-resolv.conf}} managed by ''systemd-resolved''. This propagates the systemd managed configuration to all the clients. This can be done by deleting or renaming the existing {{ic|/etc/resolv.conf}} and replacing it by a symbolic link to the systemd stub: | |||
# ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf | |||
In this mode, the DNS servers are provided in the {{man|5|resolved.conf}} file: | |||
{{hc|/etc/systemd/resolved.conf|2= | |||
[Resolve] | |||
'''DNS=91.239.100.100 89.233.43.71''' | |||
... | |||
}} | |||
In order to check the DNS actually used by ''systemd-resolved'', the command to use is: | |||
$ systemd-resolve --status | |||
{{Tip| | |||
* To understand the context around the DNS choices and switches, one can turn on detailed debug information for ''systemd-resolved'' as described in [[Systemd#Diagnosing a service]]. | |||
* The mode of operation of ''systemd-resolved'' is detected automatically, depending on whether {{ic|/etc/resolv.conf}} is a symlink to the local stub DNS resolver file or contains server names. | |||
* The | |||
}} | }} | ||
=== | == Performance == | ||
The [[#Glibc resolver]] does not cache queries. If you want local caching use [[#Systemd-resolved]] or set up a local caching [[DNS server]] and use {{ic|127.0.0.1}}. | |||
[ | {{Tip|The ''dig'' and ''drill'' [[#Lookup utilities]] report the query time.}} | ||
Internet service providers usually provide working DNS servers. A router may also add an extra DNS server in case it has its own cache server. Switching between DNS servers is transparent for Windows users, because if a DNS server is slow or does not work it will immediately switch to a better one. However, Linux usually takes longer to timeout, which could cause delays. | |||
== Lookup utilities == | |||
To query specific DNS servers and DNS/[[DNSSEC]] records you can use dedicated DNS lookup utilities. These tools implement DNS themselves and do not use [[#Name Service Switch|NSS]]. | |||
* {{Pkg|bind-tools}} provides {{man|1|dig}}, {{man|1|host}}, {{man|1|nslookup}} and a bunch of {{ic|dnssec-}} tools. | |||
* {{Pkg|ldns}} provides {{man|1|drill}}, which is similar to ''dig'' | |||
For example, to query a specific nameserver with drill for the TXT records of a domain: | |||
$ drill @''nameserver'' TXT ''domain'' | |||
If you do not specify a DNS server ''dig'' and ''drill'' use the nameservers defined in {{ic|/etc/resolv.conf}}. | |||
== See also == | |||
* [https://www.tldp.org/LDP/nag2/x-087-2-resolv.html Linux Network Administrators Guide] | |||
* [https://www.debian.org/doc/manuals/debian-handbook/sect.hostname-name-service.en.html#sect.name-resolution Debian Handbook] |
Revision as of 09:26, 26 May 2018
This article explains how to configure domain name resolution and resolve domain names.
Name Service Switch
- "NSS" redirects here. For Mozilla cryptographic libraries, see Network Security Services.
The Name Service Switch (NSS) facility is part of the GNU C Library (glibc) and backs the getaddrinfo(3) API, used to resolve domain names. NSS allows system databases to be provided by separate services, whose search order can be configured by the administrator in nsswitch.conf(5). The database responsible for domain name resolution is the hosts
database, for which glibc offers the following services:
file
: reads the/etc/hosts
file, see hosts(5)dns
: the glibc resolver which reads/etc/resolv.conf
, see resolv.conf(5)
Systemd provides three NSS services for hostname resolution:
- nss-resolve(8) - a caching DNS stub resolver, described in #Systemd-resolved
- nss-myhostname(8) - provides hostname resolution without having to edit
/etc/hosts
, described in Network configuration#Local hostname resolution - nss-mymachines(8) - provides hostname resolution for the names of local systemd-machined(8) containers
Check if you can resolve domain names
NSS databases can be queried with getent(1). You can resolve a domain name through NSS using:
$ getent hosts domain_name
resolv.conf
and/or /etc/hosts
directly. See Network configuration#Local hostname resolution.Glibc resolver
The glibc DNS resolver reads /etc/resolv.conf
(resolv.conf(5)) for every resolution to determine the nameservers and options to use.
Nameservers listed first are tried first, up to three nameservers may be listed. Lines starting with a number sign are ignored.
Overwriting of resolv.conf
Network managers tend to overwrite resolv.conf
, for specifics see the corresponding section:
To prevent programs from overwriting resolv.conf
you can also write-protect it by setting the immutable file attribute.
resolv.conf
, you can use openresolv.Limit lookup time
If you are confronted with a very long hostname lookup (may it be in pacman or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in /etc/resolv.conf
.
options timeout:1
Hostname lookup delayed with IPv6
If you experience a 5 second delay when resolving hostnames it might be due to a DNS-server/Firewall misbehaving and only giving one reply to a parallel A and AAAA request (source).
You can fix that by setting the following option in /etc/resolv.conf
:
options single-request
Local domain names
If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to resolv.conf
with the local domain such as:
domain example.com
That way you can refer to local hosts such as mainmachine1.example.com
as simply mainmachine1
when using the ssh command, but the drill command still requires the fully qualified domain names in order to perform lookups.
Systemd-resolved
systemd-resolved(8) is a systemd service that provides network name resolution to local applications via a D-Bus interface, the resolve
NSS service (nss-resolve(8)), and a local DNS stub listener on 127.0.0.53
.
systemd-resolved has four different modes for handling the glibc resolver's resolv.conf (described in systemd-resolved(8) § /ETC/RESOLV.CONF). We will focus here on the two most relevant modes.
- The mode in which systemd-resolved is a client of the
/etc/resolv.conf
. This mode preserves/etc/resolv.conf
and is compatible with the procedures described in this page. - The systemd-resolved's recommended mode of operation: the DNS stub file as indicated below contains both the local stub
127.0.0.53
as the only DNS servers and a list of search domains.
/run/systemd/resolve/stub-resolv.conf
nameserver 127.0.0.53 search lan
The service users are advised to redirect the /etc/resolv.conf
file to the local stub DNS resolver file /run/systemd/resolve/stub-resolv.conf
managed by systemd-resolved. This propagates the systemd managed configuration to all the clients. This can be done by deleting or renaming the existing /etc/resolv.conf
and replacing it by a symbolic link to the systemd stub:
# ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
In this mode, the DNS servers are provided in the resolved.conf(5) file:
/etc/systemd/resolved.conf
[Resolve] DNS=91.239.100.100 89.233.43.71 ...
In order to check the DNS actually used by systemd-resolved, the command to use is:
$ systemd-resolve --status
- To understand the context around the DNS choices and switches, one can turn on detailed debug information for systemd-resolved as described in Systemd#Diagnosing a service.
- The mode of operation of systemd-resolved is detected automatically, depending on whether
/etc/resolv.conf
is a symlink to the local stub DNS resolver file or contains server names.
Performance
The #Glibc resolver does not cache queries. If you want local caching use #Systemd-resolved or set up a local caching DNS server and use 127.0.0.1
.
Internet service providers usually provide working DNS servers. A router may also add an extra DNS server in case it has its own cache server. Switching between DNS servers is transparent for Windows users, because if a DNS server is slow or does not work it will immediately switch to a better one. However, Linux usually takes longer to timeout, which could cause delays.
Lookup utilities
To query specific DNS servers and DNS/DNSSEC records you can use dedicated DNS lookup utilities. These tools implement DNS themselves and do not use NSS.
- bind-tools provides dig(1), host(1), nslookup(1) and a bunch of
dnssec-
tools. - ldns provides drill(1), which is similar to dig
For example, to query a specific nameserver with drill for the TXT records of a domain:
$ drill @nameserver TXT domain
If you do not specify a DNS server dig and drill use the nameservers defined in /etc/resolv.conf
.