Domain name resolution
Name Service Switch
- "NSS" redirects here. For Mozilla cryptographic libraries, see Network Security Services.
The Name Service Switch (NSS) facility is part of the GNU C Library ( ) and backs the API, used to resolve domain names. NSS allows system databases to be provided by separate services, whose search order can be configured by the administrator in . The database responsible for domain name resolution is the
hosts database, for which glibc offers the following services:
file: reads the
dns: the glibc resolver which reads
Systemd provides three NSS services for hostname resolution:
- #Systemd-resolved - a caching DNS stub resolver, described in
/etc/hosts, described in Network configuration#Local hostname resolution
- provides hostname resolution without having to edit
- - provides hostname resolution for the names of local containers
Check if you can resolve domain names
NSS databases can be queried with. You can resolve a domain name through NSS using:
$ getent hosts domain_name
/etc/hostsdirectly. See Network configuration#Local hostname resolution.
The glibc resolver reads
/etc/resolv.conf for every resolution to determine the nameservers and options to use.
lists nameservers together with some configuration options. Nameservers listed first are tried first, up to three nameservers may be listed. Lines starting with a number sign are ignored.
Overwriting of resolv.conf
Network managers tend to overwrite
resolv.conf, for specifics see the corresponding section:
To prevent programs from overwriting
resolv.conf you can also write-protect it by setting the immutable file attribute.
resolv.conf, you can use openresolv.
Limit lookup time
If you are confronted with a very long hostname lookup (may it be in pacman or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in
Hostname lookup delayed with IPv6
If you experience a 5 second delay when resolving hostnames it might be due to a DNS-server/Firewall misbehaving and only giving one reply to a parallel A and AAAA request (source).
You can fix that by setting the following option in
Local domain names
If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to
resolv.conf with the local domain such as:
That way you can refer to local hosts such as
mainmachine1.example.com as simply
mainmachine1 when using the ssh command, but the drill command still requires the fully qualified domain names in order to perform lookups.
systemd-resolved has four different modes for handling the glibc resolver's resolv.conf (described in ). We will focus here on the two most relevant modes.
- The mode in which systemd-resolved is a client of the
/etc/resolv.conf. This mode preserves
/etc/resolv.confand is compatible with the procedures described in this page.
- The systemd-resolved's recommended mode of operation: the DNS stub file
/run/systemd/resolve/stub-resolv.confcontains both the local stub
127.0.0.53as the only DNS servers and a list of search domains.
The service users are advised to redirect the
/etc/resolv.conf file to the local stub DNS resolver file
/run/systemd/resolve/stub-resolv.conf managed by systemd-resolved. This propagates the systemd managed configuration to all the clients. This can be done by replacing
/etc/resolv.conf with a symbolic link to the systemd stub:
# ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
In this mode, the DNS servers are provided in thefile:
[Resolve] DNS=18.104.22.168 22.214.171.124
In order to check the DNS actually used by systemd-resolved, the command to use is:
$ resolvectl status
- To understand the context around the DNS choices and switches, one can turn on detailed debug information for systemd-resolved as described in Systemd#Diagnosing a service.
- The mode of operation of systemd-resolved is detected automatically, depending on whether
/etc/resolv.confis a symlink to the local stub DNS resolver file or contains server names.
Internet service providers usually provide working DNS servers. A router may also add an extra DNS server in case it has its own cache server. Switching between DNS servers is transparent for Windows users, because if a DNS server is slow or does not work it will immediately switch to a better one. However, Linux usually takes longer to timeout, which could cause delays.
- provides , which is a tool designed to retrieve information out of the DNS.
For example, to query a specific nameserver with drill for the TXT records of a domain:
$ drill @nameserver TXT domain
If you do not specify a DNS server drill uses the nameservers defined in
dnssec-tools. provides , , and a bunch of