Domain name resolution: Difference between revisions
(start writing intro) |
(move →Alternative DNS servers: to Alternative DNS services as it does not describe Domain name resolution and it's getting in my way) |
||
| Line 153: | Line 153: | ||
That way you can refer to local hosts such as {{ic|mainmachine1.example.com}} as simply {{ic|mainmachine1}} when using the ''ssh'' command, but the ''drill'' command still requires the fully qualified domain names in order to perform lookups. | That way you can refer to local hosts such as {{ic|mainmachine1.example.com}} as simply {{ic|mainmachine1}} when using the ''ssh'' command, but the ''drill'' command still requires the fully qualified domain names in order to perform lookups. | ||
Revision as of 04:56, 23 May 2018
The GNU C Library (glibc) provides the getaddrinfo(3) API to resolve domain names. The API is backed by the Network Service Switch (NSS) module, which is configured in nsswitch.conf(5).
The configuration file for DNS resolvers is /etc/resolv.conf. From resolv.conf(5):
- The resolver is a set of routines in the C library that provide access to the Domain Name System. The resolver configuration file contains information that is read by the resolver routines the first time they are invoked by a process. The file is designed to be human readable and contains a list of keywords with values that provide various types of resolver information.
- If this file does not exist, only the name server on the local machine will be queried; the domain name is determined from the hostname and the domain search path is constructed from the domain name.
To use #Alternative DNS servers, edit /etc/resolv.conf and add them at the top of the list so they are used first, optionally removing or commenting out other servers. Currently, you may include a maximum of three nameservers.
/etc/resolv.conf take effect immediately.127.0.0.1.DNS in Linux
ISPs usually provide working DNS servers. A router may also add an extra DNS server in case it has its own cache server. Switching between DNS servers is transparent for Windows users, because if a DNS server is slow or does not work it will immediately switch to a better one. However, Linux usually takes longer to timeout, which could be the reason why you are getting a delay.
Testing
Use drill (provided by package ldns) before any changes, repeat after making the adjustments and compare the query time(s). The following command uses the nameservers set in /etc/resolv.conf:
$ drill www.archlinux.org
You can also specify a specific nameserver's ip address, bypassing the settings in your /etc/resolv.conf:
$ drill @ip.of.name.server www.archlinux.org
For example to test Google's name servers:
$ drill @8.8.8.8 www.archlinux.org
To test a local name server (such as unbound) do:
$ drill @127.0.0.1 www.archlinux.org
Preserve DNS settings
dhcpcd, netctl, NetworkManager, and various other processes can overwrite /etc/resolv.conf. This is usually desirable behavior, but sometimes DNS settings need to be set manually (e.g. when using a static IP address). There are several ways to accomplish this.
- If you are using dhcpcd, see #Modify the dhcpcd config below.
- If you are using netctl and static IP address assignment, do not use the
DNS*options in your profile, otherwise resolvconf is called and/etc/resolv.confoverwritten.
Systemd-resolved configuration
systemd-resolved(8) is a systemd service that provides network name resolution to local applications. systemd-resolved has four different modes for handling resolv.conf. We will focus here on the two most relevant modes.
- The mode in which systemd-resolved is a client of the
/etc/resolv.conf. This mode preserves/etc/resolv.confand is compatible with the procedures described in this page. - The systemd-resolved's recommended mode of operation: the DNS stub file as indicated below contains both the local stub
127.0.0.53as the only DNS servers and a list of search domains.
/run/systemd/resolve/stub-resolv.conf
nameserver 127.0.0.53 search lan
The service users are advised to redirect the /etc/resolv.conf file to the local stub DNS resolver file /run/systemd/resolve/stub-resolv.conf managed by systemd-resolved. This propagates the systemd managed configuration to all the clients. This can be done by deleting or renaming the existing /etc/resolv.conf and replacing it by a symbolic link to the systemd stub:
# ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
In this mode, the DNS servers are provided in the resolved.conf(5) file:
/etc/systemd/resolved.conf
[Resolve] DNS=91.239.100.100 89.233.43.71 ...
In order to check the DNS actually used by systemd-resolved, the command to use is:
$ systemd-resolve --status
- To understand the context around the DNS choices and switches, one can turn on detailed debug information for systemd-resolved as described in Systemd#Diagnosing a service.
- The mode of operation of systemd-resolved is detected automatically, depending on whether
/etc/resolv.confis a symlink to the local stub DNS resolver file or contains server names.
Prevent NetworkManager modifications
To stop NetworkManager from modifying /etc/resolv.conf, edit /etc/NetworkManager/NetworkManager.conf and add the following in the [main] section:
dns=none
/etc/resolv.conf might be a broken symlink that you will need to remove after doing that. Then, just create a new /etc/resolv.conf file.
NetworkManager also offers hooks via so called dispatcher scripts that can be used to alter the /etc/resolv.conf after network changes. See NetworkManager#Network services with NetworkManager dispatcher and NetworkManager(8) for more information.
Openresolv
openresolv provides a utility resolvconf, which is a framework for managing multiple DNS configurations. See resolvconf(8) and resolvconf.conf(5) for more information.
The configuration is done in /etc/resolvconf.conf and running resolvconf -u will generate /etc/resolv.conf.
Note that NetworkManager can be configured to use openresolv, see NetworkManager#Configure NetworkManager resolv.conf management mode to use resolvconf.
Modify the dhcpcd config
dhcpcd's configuration file may be edited to prevent the dhcpcd daemon from overwriting /etc/resolv.conf. To do this, add the following to the last section of /etc/dhcpcd.conf:
nohook resolv.conf
Alternatively, you can create a file called /etc/resolv.conf.head containing your DNS servers. dhcpcd will prepend this file to the beginning of /etc/resolv.conf.
Or you can configure dhcpcd to use the same DNS servers every time. To do this, add the following line at the end of your /etc/dhcpcd.conf, where dns-server-ip-addressses is a space separated list of DNS IP addresses.
static domain_name_servers=dns-server-ip-addresses
For example, to set it to Google's DNS servers:
static domain_name_servers=8.8.8.8 8.8.4.4
Write-protect resolv.conf
Another way to protect your /etc/resolv.conf from being modified by anything is setting the immutable (write-protection) attribute:
# chattr +i /etc/resolv.conf
Tips and tricks
Limit lookup time
If you are confronted with a very long hostname lookup (may it be in pacman or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in /etc/resolv.conf.
options timeout:1
Hostname lookup delayed with IPv6
If you experience a 5 second delay when resolving hostnames it might be due to a DNS-server/Firewall misbehaving and only giving one reply to a parallel A and AAAA request (source).
You can fix that by setting the following option in /etc/resolv.conf:
options single-request
Local domain names
If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to resolv.conf with the local domain such as:
domain example.com
That way you can refer to local hosts such as mainmachine1.example.com as simply mainmachine1 when using the ssh command, but the drill command still requires the fully qualified domain names in order to perform lookups.