Difference between revisions of "Domain name resolution"

From ArchWiki
Jump to: navigation, search
(Systemd-resolved: don't complicate things, just replace the file)
(Resolvers: expand note with downgrade attacks)
 
(23 intermediate revisions by 3 users not shown)
Line 25: Line 25:
 
[[Systemd]] provides three NSS services for hostname resolution:
 
[[Systemd]] provides three NSS services for hostname resolution:
  
* {{man|8|nss-resolve}} - a caching DNS stub resolver, described in [[#Systemd-resolved]]
+
* {{man|8|nss-resolve}} - a caching DNS stub resolver, described in [[systemd-resolved]]
 
* {{man|8|nss-myhostname}} - provides hostname resolution without having to edit {{ic|/etc/hosts}}, described in [[Network configuration#Local hostname resolution]]
 
* {{man|8|nss-myhostname}} - provides hostname resolution without having to edit {{ic|/etc/hosts}}, described in [[Network configuration#Local hostname resolution]]
 
* {{man|8|nss-mymachines}} - provides hostname resolution for the names of local {{man|8|systemd-machined}} containers  
 
* {{man|8|nss-mymachines}} - provides hostname resolution for the names of local {{man|8|systemd-machined}} containers  
Line 35: Line 35:
 
  $ getent hosts ''domain_name''
 
  $ getent hosts ''domain_name''
  
{{Note|While most programs resolve domain names using NSS, some may read {{ic|resolv.conf}} and/or {{ic|/etc/hosts}} directly. See [[Network configuration#Local hostname resolution]].}}
+
{{Note|While most programs resolve domain names using NSS, some may read {{ic|/etc/resolv.conf}} and/or {{ic|/etc/hosts}} directly. See [[Network configuration#Local hostname resolution]].}}
  
 
== Glibc resolver ==
 
== Glibc resolver ==
Line 44: Line 44:
 
Nameservers listed first are tried first, up to three nameservers may be listed. Lines starting with a number sign are ignored.
 
Nameservers listed first are tried first, up to three nameservers may be listed. Lines starting with a number sign are ignored.
  
{{Note|The glibc resolver does not cache queries. See [[#Performance]] for more information.}}
+
{{Note|The glibc resolver does not cache queries. To improve query lookup time you can set up a caching resolver. See [[#Resolvers]] for more information.}}
  
 
=== Overwriting of resolv.conf ===
 
=== Overwriting of resolv.conf ===
  
[[Network manager]]s tend to overwrite {{ic|resolv.conf}}, for specifics see the corresponding section:
+
[[Network manager]]s tend to overwrite {{ic|/etc/resolv.conf}}, for specifics see the corresponding section:
  
 
* [[dhcpcd#resolv.conf]]
 
* [[dhcpcd#resolv.conf]]
Line 54: Line 54:
 
* [[NetworkManager#resolv.conf]]
 
* [[NetworkManager#resolv.conf]]
  
To prevent programs from overwriting {{ic|resolv.conf}} you can also write-protect it by setting the immutable [[file attribute]].
+
To prevent programs from overwriting {{ic|/etc/resolv.conf}} you can also write-protect it by setting the immutable [[file attribute]].
  
{{Tip|If you want multiple processes to write to {{ic|resolv.conf}}, you can use [[openresolv]].}}
+
{{Tip|If you want multiple processes to write to {{ic|/etc/resolv.conf}}, you can use [[openresolv]].}}
  
 
=== Limit lookup time ===
 
=== Limit lookup time ===
Line 73: Line 73:
 
=== Local domain names ===
 
=== Local domain names ===
  
If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to {{ic|resolv.conf}} with the local domain such as:
+
If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to {{ic|/etc/resolv.conf}} with the local domain such as:
  
 
  domain example.com
 
  domain example.com
Line 79: Line 79:
 
That way you can refer to local hosts such as {{ic|mainmachine1.example.com}} as simply {{ic|mainmachine1}} when using the ''ssh'' command, but the ''drill'' command still requires the fully qualified domain names in order to perform lookups.
 
That way you can refer to local hosts such as {{ic|mainmachine1.example.com}} as simply {{ic|mainmachine1}} when using the ''ssh'' command, but the ''drill'' command still requires the fully qualified domain names in order to perform lookups.
  
== Systemd-resolved ==
+
== Resolvers ==
  
{{man|8|systemd-resolved}} is a [[systemd]] service that provides network name resolution to local applications via a [[D-Bus]] interface, the {{ic|resolve}} NSS service ({{man|8|nss-resolve}}), and a local DNS stub listener on {{ic|127.0.0.53}}.
+
{{Expansion|Fill in the unknowns.}}
  
''systemd-resolved'' has four different modes for handling the [[#Glibc resolver|glibc resolver]]'s ''resolv.conf'' (described in {{man|8|systemd-resolved|/ETC/RESOLV.CONF}}). We will focus here on the two most relevant modes.
+
The Glibc resolver provides only the most basic necessities, it does not cache queries or provide any security or privacy features. If you desire more functionality use another resolver.
 
 
# The mode in which ''systemd-resolved'' is a client of the {{ic|/etc/resolv.conf}}. This mode preserves {{ic|/etc/resolv.conf}} and is '''compatible''' with the procedures described in this page.
 
# The ''systemd-resolved'''s '''recommended''' mode of operation: the DNS stub file {{ic|/run/systemd/resolve/stub-resolv.conf}} contains both the local stub {{ic|127.0.0.53}} as the only DNS servers and a list of search domains.
 
 
 
The service users are advised to redirect the {{ic|/etc/resolv.conf}} file to the local stub DNS resolver file {{ic|/run/systemd/resolve/stub-resolv.conf}} managed by ''systemd-resolved''. This propagates the systemd managed configuration to all the clients. This can be done by replacing {{ic|/etc/resolv.conf}} with a symbolic link to the systemd stub:
 
 
 
# ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
 
 
 
In this mode, the DNS servers are provided in the {{man|5|resolved.conf}} file:
 
 
 
{{hc|/etc/systemd/resolved.conf.d/dns_servers.conf|2=
 
[Resolve]
 
'''DNS=91.239.100.100 89.233.43.71'''
 
}}
 
 
 
In order to check the DNS actually used by ''systemd-resolved'', the command to use is:
 
 
 
$ resolvectl status
 
  
 
{{Tip|
 
{{Tip|
* To understand the context around the DNS choices and switches, one can turn on detailed debug information for ''systemd-resolved'' as described in [[Systemd#Diagnosing a service]].
+
* The ''drill'' or ''dig'' [[#Lookup utilities|lookup utilities]] report the query time.
* The mode of operation of ''systemd-resolved'' is detected automatically, depending on whether {{ic|/etc/resolv.conf}} is a symlink to the local stub DNS resolver file or contains server names.
+
* A router usually sets its own caching resolver as the network's DNS server thus proving DNS cache for the whole network.
 +
* If it takes too long to switch to the next DNS server you can try [[#Limit lookup time|decreasing the timeout]].
 
}}
 
}}
  
== Performance ==
+
The columns have the following meaning:
  
The [[#Glibc resolver]] does not cache queries. If you want local caching use [[#Systemd-resolved]] or set up a local caching [[DNS server]] and use {{ic|127.0.0.1}}.
+
* ''Cache'': [[Wikipedia:Name server#Caching name server|caches]] the DNS queries to improve lookup times of subsequent identical requests.
 +
* ''Recursor'': can [[Wikipedia:Name server#Recursive query|recursively query]] the domain name starting from the [[Wikipedia:DNS root zone|DNS root zone]].
 +
* ''resolvconf compatibility'': can acquire name servers and search domains, to use for forwarding requests, from software that sets them using [[Wikipedia:resolvconf|resolvconf]].
 +
* ''Validates DNSSEC'': [[Wikipedia:Domain Name System Security Extensions#The lookup procedure|validates]] DNS query responses using [[DNSSEC]].
 +
* ''DNS over TLS'': supports the [[Wikipedia:DNS over TLS|DNS over TLS]] protocol for encrypted communicating with the DNS server.
 +
* ''DNS over HTTPS'': supports the [[Wikipedia:DNS over HTTPS|DNS over HTTPS]] protocol for encrypted communicating with the DNS server.
  
{{Tip|The ''drill'' or ''dig'' [[#Lookup utilities]] report the query time.}}
+
{| class="wikitable sortable" style="text-align:center"
 +
! Resolver !! Cache !! Recursor !! ''resolvconf'' compatibility !!  Validates DNSSEC !! DNS over TLS !! DNS over HTTPS !! Notes
 +
|-
 +
! [[#Glibc resolver|glibc]]
 +
| {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} ||
 +
|-
 +
! [[BIND]]
 +
| {{Yes}} || {{Yes}} || {{G|[[openresolv]] subscriber}} || {{Yes}} || ? || ? ||
 +
|-
 +
! [[dnscrypt-proxy]]
 +
| {{Yes}} || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{L|Implements the [[Wikipedia:DNSCrypt|DNSCrypt]] protocol.}}
 +
|-
 +
! [[dnsmasq]]
 +
| {{Yes}} || {{No}} || {{G|[[openresolv]] subscriber}} || {{Yes}} || {{No}} || {{No}} ||
 +
|-
 +
! [[Knot Resolver]]
 +
| {{Yes}} || {{Yes}} || {{No}} || {{Yes}} || {{Yes}} || {{No}} [https://gitlab.labs.nic.cz/knot/knot-resolver/issues/243] ||
 +
|-
 +
! [[pdnsd]]
 +
| {{Yes}} || {{Yes}} || {{G|[[openresolv]] subscriber}} || {{No}} || {{No}} || {{No}} ||
 +
|-
 +
! [[Stubby]]
 +
| {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || ? ||
 +
|-
 +
!style="white-space: nowrap;"| [[systemd-resolved]]
 +
| {{Yes}} || {{No}} || {{G|[[systemd-resolvconf]]}} || {{Yes}} || {{Y|Insecure}}<sup>1</sup> || {{No}} [https://github.com/systemd/systemd/issues/8639] ||
 +
|-
 +
! [[Unbound]]
 +
| {{Yes}} || {{Yes}} || {{G|[[openresolv]] subscriber}} || {{Yes}} || {{Yes}} || ? ||
 +
|}
  
Internet service providers usually provide working DNS servers. A router may also add an extra DNS server in case it has its own cache server. Switching between DNS servers is transparent for Windows users, because if a DNS server is slow or does not work it will immediately switch to a better one. However, Linux usually takes longer to timeout, which could cause delays.
+
# From {{man|5|resolved.conf}}: ''Note as the resolver is not capable of authenticating the server, it is vulnerable for "man-in-the-middle" attacks.''[https://github.com/systemd/systemd/issues/9397] Also, the only supported mode is "opportunistic", which ''makes DNS-over-TLS vulnerable to "downgrade" attacks''.
  
 
== Privacy ==
 
== Privacy ==

Latest revision as of 15:25, 12 August 2018

In general, a domain name represents an IP address and is associated to it in the Domain Name System (DNS). This article explains how to configure domain name resolution and resolve domain names.

Name Service Switch

"NSS" redirects here. For Mozilla cryptographic libraries, see Network Security Services.

The Name Service Switch (NSS) facility is part of the GNU C Library (glibc) and backs the getaddrinfo(3) API, used to resolve domain names. NSS allows system databases to be provided by separate services, whose search order can be configured by the administrator in nsswitch.conf(5). The database responsible for domain name resolution is the hosts database, for which glibc offers the following services:

Systemd provides three NSS services for hostname resolution:

Check if you can resolve domain names

NSS databases can be queried with getent(1). You can resolve a domain name through NSS using:

$ getent hosts domain_name
Note: While most programs resolve domain names using NSS, some may read /etc/resolv.conf and/or /etc/hosts directly. See Network configuration#Local hostname resolution.

Glibc resolver

The glibc resolver reads /etc/resolv.conf for every resolution to determine the nameservers and options to use.

resolv.conf(5) lists nameservers together with some configuration options. Nameservers listed first are tried first, up to three nameservers may be listed. Lines starting with a number sign are ignored.

Note: The glibc resolver does not cache queries. To improve query lookup time you can set up a caching resolver. See #Resolvers for more information.

Overwriting of resolv.conf

Network managers tend to overwrite /etc/resolv.conf, for specifics see the corresponding section:

To prevent programs from overwriting /etc/resolv.conf you can also write-protect it by setting the immutable file attribute.

Tip: If you want multiple processes to write to /etc/resolv.conf, you can use openresolv.

Limit lookup time

If you are confronted with a very long hostname lookup (may it be in pacman or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in /etc/resolv.conf.

options timeout:1

Hostname lookup delayed with IPv6

If you experience a 5 second delay when resolving hostnames it might be due to a DNS-server/Firewall misbehaving and only giving one reply to a parallel A and AAAA request (source). You can fix that by setting the following option in /etc/resolv.conf:

options single-request

Local domain names

If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to /etc/resolv.conf with the local domain such as:

domain example.com

That way you can refer to local hosts such as mainmachine1.example.com as simply mainmachine1 when using the ssh command, but the drill command still requires the fully qualified domain names in order to perform lookups.

Resolvers

Tango-view-fullscreen.pngThis article or section needs expansion.Tango-view-fullscreen.png

Reason: Fill in the unknowns. (Discuss in Talk:Domain name resolution#)

The Glibc resolver provides only the most basic necessities, it does not cache queries or provide any security or privacy features. If you desire more functionality use another resolver.

Tip:
  • The drill or dig lookup utilities report the query time.
  • A router usually sets its own caching resolver as the network's DNS server thus proving DNS cache for the whole network.
  • If it takes too long to switch to the next DNS server you can try decreasing the timeout.

The columns have the following meaning:

  • Cache: caches the DNS queries to improve lookup times of subsequent identical requests.
  • Recursor: can recursively query the domain name starting from the DNS root zone.
  • resolvconf compatibility: can acquire name servers and search domains, to use for forwarding requests, from software that sets them using resolvconf.
  • Validates DNSSEC: validates DNS query responses using DNSSEC.
  • DNS over TLS: supports the DNS over TLS protocol for encrypted communicating with the DNS server.
  • DNS over HTTPS: supports the DNS over HTTPS protocol for encrypted communicating with the DNS server.
Resolver Cache Recursor resolvconf compatibility Validates DNSSEC DNS over TLS DNS over HTTPS Notes
glibc No No No No No No
BIND Yes Yes openresolv subscriber Yes  ?  ?
dnscrypt-proxy Yes No No No No Yes Implements the DNSCrypt protocol.
dnsmasq Yes No openresolv subscriber Yes No No
Knot Resolver Yes Yes No Yes Yes No [1]
pdnsd Yes Yes openresolv subscriber No No No
Stubby No No No Yes Yes  ?
systemd-resolved Yes No systemd-resolvconf Yes Insecure1 No [2]
Unbound Yes Yes openresolv subscriber Yes Yes  ?
  1. From resolved.conf(5): Note as the resolver is not capable of authenticating the server, it is vulnerable for "man-in-the-middle" attacks.[3] Also, the only supported mode is "opportunistic", which makes DNS-over-TLS vulnerable to "downgrade" attacks.

Privacy

Most DNS servers keep a log of IP addresses and sites visited on a more or less temporary basis. The data collected can be used to perform various statistical studies. Personally-identifying information have value and can also be rented or sold to third parties. Alternative DNS services provides a list of popular services, check their privacy policy for information about how user data is handled.

Lookup utilities

To query specific DNS servers and DNS/DNSSEC records you can use dedicated DNS lookup utilities. These tools implement DNS themselves and do not use NSS.

  • ldns provides drill(1), which is a tool designed to retrieve information out of the DNS.

For example, to query a specific nameserver with drill for the TXT records of a domain:

$ drill @nameserver TXT domain

If you do not specify a DNS server drill uses the nameservers defined in /etc/resolv.conf.

See also