Difference between revisions of "Domain name resolution"

From ArchWiki
Jump to navigation Jump to search
(→‎DNS servers: systemd-resolved's DNS over TLS resolver should be secure since version 245.2-2)
 
(394 intermediate revisions by 40 users not shown)
Line 1: Line 1:
 
[[Category:Domain Name System]]
 
[[Category:Domain Name System]]
 +
[[Category:Network configuration]]
 
[[de:Resolv.conf]]
 
[[de:Resolv.conf]]
[[es:Resolv.conf]]
+
[[es:Domain name resolution]]
 
[[fr:Resolv.conf]]
 
[[fr:Resolv.conf]]
 
[[it:Resolv.conf]]
 
[[it:Resolv.conf]]
 
[[ja:Resolv.conf]]
 
[[ja:Resolv.conf]]
[[zh-CN:Resolv.conf]]
+
[[pt:Domain name resolution]]
The configuration file for DNS resolvers is {{ic|/etc/resolv.conf}}. From its [http://www.kernel.org/doc/man-pages/online/pages/man5/resolv.conf.5.html man page]:
+
[[zh-hans:Domain name resolution]]
:''"The resolver is a set of routines in the C library that provide access to the Internet Domain Name System (DNS). The resolver configuration file contains information that is read by the resolver routines the first time they are invoked by a process. The file is designed to be human readable and contains a list of keywords with values that provide various types of resolver information.''
+
{{Related articles start}}
 +
{{Related|Network configuration}}
 +
{{Related|DNS over HTTPS servers}}
 +
{{Related articles end}}
 +
In general, a [[Wikipedia:Domain name|domain name]] represents an IP address and is associated to it in the [[Wikipedia:Domain Name System|Domain Name System]] (DNS).
 +
This article explains how to configure domain name resolution and resolve domain names.
  
:''"On a normally configured system this file should not be necessary. The only name server to be queried will be on the local machine; the domain name is determined from the host name and the domain search path is constructed from the domain name."''
+
== Name Service Switch ==
  
== DNS in Linux ==
+
{{Expansion|Mention {{Pkg|nss-mdns}}, {{AUR|nss-tls-git}} and others.}}
  
Your ISP (usually) provides working [[wikipedia:Domain_Name_System|DNS]] servers, and a router may also add an extra DNS server in case you have your own cache server. Switching between DNS servers does not represent a problem for Windows users, because if a DNS server is slow or does not work it will immediately switch to a better one. However, Linux usually takes longer to timeout, which could be the reason why you are getting a delay.
+
The [[Wikipedia:Name Service Switch|Name Service Switch]] (NSS) facility is part of the GNU C Library ({{Pkg|glibc}}) and backs the {{man|3|getaddrinfo}} API, used to resolve domain names. NSS allows system databases to be provided by separate services, whose search order can be configured by the administrator in {{man|5|nsswitch.conf}}. The database responsible for domain name resolution is the ''hosts'' database, for which glibc offers the following services:
  
Use ''dig'' (provided by package {{Pkg|dnsutils}}) before any changes, repeat after making the adjustments in the section below and compare the query time(s):
+
* ''file'': reads the {{ic|/etc/hosts}} file, see {{man|5|hosts}}
$ dig www5.yahoo.com
+
* ''dns'': the [[#Glibc resolver|glibc resolver]] which reads {{ic|/etc/resolv.conf}}, see {{man|5|resolv.conf}}
  
You can also specify a nameserver:
+
[[Systemd]] provides three NSS services for hostname resolution:
$ dig @ip.of.name.server www5.yahoo.com
 
  
== Alternative DNS servers ==
+
* {{man|8|nss-resolve}} - a caching DNS stub resolver, described in [[systemd-resolved]]
 +
* {{man|8|nss-myhostname}} - provides hostname resolution without having to edit {{ic|/etc/hosts}}, described in [[Network configuration#Local hostname resolution]]
 +
* {{man|8|nss-mymachines}} - provides hostname resolution for the names of local {{man|8|systemd-machined}} containers
  
To use alternative DNS servers, edit {{ic|/etc/resolv.conf}} and add them to the top of the file so they are used first, optionally removing or commenting out already listed servers.
+
=== Resolve a domain name using NSS ===
  
{{Note|Changes made to {{ic|/etc/resolv.conf}} take effect immediately.}}
+
NSS databases can be queried with {{man|1|getent}}. A domain name can be resolved through NSS using:
  
=== OpenNIC ===
+
$ getent hosts ''domain_name''
  
[http://www.opennicproject.org/ OpenNIC] provides free uncensored nameservers with additional features.
+
{{Note|While most programs resolve domain names using NSS, some may read {{ic|/etc/resolv.conf}} and/or {{ic|/etc/hosts}} directly. See [[Network configuration#Local hostname resolution]].}}
  
{{Tip|OpenNIC offers many [http://wiki.opennicproject.org/Tier2 different nameservers] located in multiple countries. Pick some of the [http://www.opennicproject.org/nearest-servers/ nearest nameservers] for optimal performance.}}
+
== Glibc resolver ==
  
# OpenNIC IPv4 nameservers (US)
+
The glibc resolver reads {{ic|/etc/resolv.conf}} for every resolution to determine the nameservers and options to use.  
nameserver 107.170.95.180
 
nameserver 75.127.14.107
 
  
=== OpenDNS ===
+
{{man|5|resolv.conf}} lists nameservers together with some configuration options.
 +
Nameservers listed first are tried first, up to three nameservers may be listed. Lines starting with a number sign ({{ic|#}}) are ignored.
  
[https://opendns.com OpenDNS] provides free alternative nameservers:
+
{{Note|The glibc resolver does not cache queries. To improve query lookup time you can set up a caching resolver. Glibc resolver also can not validate DNSSEC. A DNSSEC capable validator resolver is required for that one. See [[#DNS servers]] for more information.}}
  
# OpenDNS IPv4 nameservers
+
=== Overwriting of /etc/resolv.conf ===
nameserver 208.67.222.222
 
nameserver 208.67.220.220
 
  
# OpenDNS IPv6 nameservers
+
[[Network manager]]s tend to overwrite {{ic|/etc/resolv.conf}}, for specifics see the corresponding section:
nameserver 2620:0:ccc::2
 
nameserver 2620:0:ccd::2
 
  
=== Google ===
+
* [[dhcpcd#/etc/resolv.conf]]
 +
* [[netctl#resolv.conf]]
 +
* [[NetworkManager#/etc/resolv.conf]]
  
[https://developers.google.com/speed/public-dns/ Google's nameservers] can be used as an alternative:
+
To prevent programs from overwriting {{ic|/etc/resolv.conf}}, it is also possible to write-protect it by setting the immutable [[file attribute]]:
  
  # Google IPv4 nameservers
+
  # chattr +i /etc/resolv.conf
  nameserver 8.8.8.8
+
 
  nameserver 8.8.4.4
+
{{Tip|If you want multiple processes to write to {{ic|/etc/resolv.conf}}, you can use [[resolvconf]].}}
 +
 
 +
=== Limit lookup time ===
 +
 
 +
If you are confronted with a very long hostname lookup (may it be in [[pacman]] or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in {{ic|/etc/resolv.conf}}.
 +
 
 +
  options timeout:1
 +
 
 +
=== Hostname lookup delayed with IPv6 ===
 +
 
 +
If you experience a 5 second delay when resolving hostnames it might be due to a DNS-server/Firewall misbehaving and only giving one reply to a parallel A and AAAA request.[https://udrepper.livejournal.com/20948.html] You can fix that by setting the following option in {{ic|/etc/resolv.conf}}:
 +
 
 +
options single-request
 +
 
 +
=== Local domain names ===
 +
 
 +
To be able to use the hostname of local machine names without the fully qualified domain name, add a line to {{ic|/etc/resolv.conf}} with the local domain such as:
 +
  domain example.org
 +
That way you can refer to local hosts such as {{ic|mainmachine1.example.org}} as simply {{ic|mainmachine1}} when using the ''ssh'' command, but the [[#Lookup utilities|drill]] command still requires the fully qualified domain names in order to perform lookups.
 +
 
 +
== Lookup utilities ==
 +
 
 +
To query specific DNS servers and DNS/[[DNSSEC]] records you can use dedicated DNS lookup utilities. These tools implement DNS themselves and do not use [[#Name Service Switch|NSS]].
 +
 
 +
* {{Pkg|ldns}} provides {{man|1|drill}}, which is a tool designed to retrieve information out of the DNS.
 +
 
 +
For example, to query a specific nameserver with ''drill'' for the TXT records of a domain:
  
  # Google IPv6 nameservers
+
  $ drill @''nameserver'' TXT ''domain''
nameserver 2001:4860:4860::8888
 
nameserver 2001:4860:4860::8844
 
  
=== Comodo ===
+
Unless a DNS server is specified, ''drill'' will use the nameservers defined in {{ic|/etc/resolv.conf}}.
[http://securedns.dnsbycomodo.com/ Comodo] provides another IPv4 set, with optional (non-free) web-filtering. Implied in this feature is that the service hijacks the queries.  
 
  
# Comodo nameservers
+
* {{Pkg|bind-tools}} provides {{man|1|dig}}, {{man|1|host}}, {{man|1|nslookup}} and a bunch of {{ic|dnssec-}} tools.
nameserver 8.26.56.26
 
nameserver 8.20.247.20
 
  
=== Yandex ===
+
{{Tip|Some DNS servers ship with their own DNS lookup utilities. E.g. {{Pkg|knot}} has {{man|1|khost}} and {{man|1|kdig}}, [[Unbound]]—{{man|1|unbound-host}}.}}
[http://dns.yandex.ru/ Yandex.DNS] have a 3 models:
 
  
# Basic Yandex.DNS - Quick and reliable DNS
+
== Resolver performance ==
nameserver 77.88.8.8
 
nameserver 77.88.8.1
 
  
# Safe Yandex.DNS - Protection from virus and fraudulent content
+
The Glibc resolver does not cache queries. To implement local caching, use [[systemd-resolved]] or set up a local caching [[#DNS servers|DNS server]] and use it as the name server by setting {{ic|127.0.0.1}} and {{ic|::1}} as the name servers in {{ic|/etc/resolv.conf}} or in {{ic|/etc/resolvconf.conf}} if using [[openresolv]].
nameserver 77.88.8.88
 
nameserver 77.88.8.2
 
  
# Family Yandex.DNS - Without adult content
+
{{Tip|
nameserver 77.88.8.7
+
* The ''drill'' or ''dig'' [[#Lookup utilities|lookup utilities]] report the query time.
nameserver 77.88.8.3
+
* A router usually sets its own caching resolver as the network's DNS server thus providing DNS cache for the whole network.  
 +
* If it takes too long to switch to the next DNS server you can try [[#Limit lookup time|decreasing the timeout]].}}
  
=== UncensoredDNS ===
+
== Privacy and security ==
  
[http://censurfridns.dk UncensoredDNS] is a free uncensored DNS resolver who also answers queries on port 5353 if you are behind a firewall blocking outgoing port 53.
+
The DNS protocol is unencrypted and does not account for confidentiality, integrity or authentication, so if you use an untrusted network or a malicious ISP, your DNS queries can be eavesdropped and the responses [[Wikipedia:Man-in-the-middle attack|manipulated]]. Furthermore, DNS servers can conduct [[Wikipedia:DNS hijacking|DNS hijacking]].
  
# censurfridns.dk IPv4 nameservers
+
You need to trust your DNS server to treat your queries confidentially. DNS servers are provided by ISPs and [[#Third-party DNS services|third-parties]]. Alternatively you can run your own [[#DNS servers|recursive name server]], which however takes more effort. If you use a [[DHCP]] client in untrusted networks, be sure to set static name servers to avoid using and being subject to arbitrary DNS servers. To secure your communication with a remote DNS server you can use an encrypted protocol, like [[Wikipedia:DNS over TLS|DNS over TLS]] ([[RFC:7858|RFC 7858]]), [[Wikipedia:DNS over HTTPS|DNS over HTTPS]] ([[RFC:8484|RFC 8484]]), or [[Wikipedia:DNSCrypt|DNSCrypt]], provided that both the upstream server and your [[#DNS servers|resolver]] support the protocol. An alternative can be a dedicated software to encrypt and decrypt the communication, such as [[stunnel]]. To verify that responses are actually from [[Wikipedia:Authoritative name server|authoritative name servers]], you can validate [[DNSSEC]], provided that both the upstream server(s) and your [[#DNS servers|resolver]] support it.
nameserver 91.239.100.100    ## anycast.censurfridns.dk
 
nameserver 89.233.43.71      ## ns1.censurfridns.dk
 
  
# censurfridns.dk IPv6 nameservers
+
=== Application-level DNS ===
nameserver 2001:67c:28a4::            ## anycast.censurfridns.dk
 
nameserver 2002:d596:2a92:1:71:53::    ## ns1.censurfridns.dk
 
  
== Preserve DNS settings ==
+
Be aware that some client software, such as major web browsers[https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/#trr-and-doh][https://www.chromium.org/developers/dns-over-https], are starting to implement DNS over HTTPS. While the encryption of queries may often be seen as a bonus, it also means the software sidetracks queries around the system resolver configuration.[https://blog.powerdns.com/2019/09/25/centralised-doh-is-bad-for-privacy-in-2019-and-beyond/]
  
[[dhcpcd]], [[netctl]], [[NetworkManager]], and various other processes can overwrite {{ic|/etc/resolv.conf}}. This is usually desirable behavior, but sometimes DNS settings need to be set manually (e.g. when using a static IP address). There are several ways to accomplish this.
+
[https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https Mozilla has proposed] disabling application-level DNS if the system resolver cannot resolve the domain "[http://use-application-dns.net/ use-application-dns.net]". Currently this check is only implemented in [[Firefox]].
*If you are using ''dhcpcd'', see [[#Modify the dhcpcd config]] below.
 
*If you are using [[netctl]] and static IP address assignment, do not use the {{ic|DNS*}} options in your profile, otherwise ''resolvconf'' is called and {{ic|/etc/resolv.conf}} overwritten.
 
  
=== Using openresolv ===
+
{{Expansion|Explain why is it necessary or what are the benefits of configuring DNS over HTTPS in web browsers over running a [[#DNS servers|stub resolver]].}}
  
{{Pkg|openresolv}} provides a utility ''resolvconf'', which is a framework for managing multiple DNS configurations. See {{ic|man 8 resolvconf}} and {{ic|man 5 resolvconf.conf}} for more information.
+
==== Configuring DNS over HTTPS in Firefox ====
  
The configuration is done in {{ic|/etc/resolvconf.conf}} and running {{ic|resolvconf -u}} will generate {{ic|/etc/resolv.conf}}.
+
In order to configure DNS over HTTPS in [[Firefox]] (based on [https://support.mozilla.org/en-US/kb/firefox-dns-over-https]):
  
=== Modify the dhcpcd config ===
+
# open ''Network Settings'' in ''Preferences''
 +
# click ''Settings''
 +
# check ''Enable DNS over HTTPS''
  
''dhcpcd'''s configuration file may be edited to prevent the ''dhcpcd'' daemon from overwriting {{ic|/etc/resolv.conf}}. To do this, add the following to the last section of {{ic|/etc/dhcpcd.conf}}:
+
== Third-party DNS services ==
  
nohook resolv.conf
+
{{Note|Before using a third-party DNS service, check its privacy policy for information on how user data is handled. User data has value and can be sold to other parties.}}
  
Alternatively, you can create a file called {{ic|/etc/resolv.conf.head}} containing your DNS servers. ''dhcpcd'' will prepend this file to the beginning of {{ic|/etc/resolv.conf}}.
+
There are various [[Wikipedia:Public recursive name server#List of public DNS service operators|third-party DNS services]] available, some of which also have dedicated software:
  
Or you can configure dhcpcd to use the same DNS servers every time. To do this, add the following line at the end of your {{ic|/etc/dhcpcd.conf}}:
+
* {{App|dingo|A DNS client for Google DNS over HTTPS|https://github.com/pforemski/dingo|{{AUR|dingo-git}}}}
 +
* {{App|opennic-up|Automates the renewal of the DNS servers with the most responsive OpenNIC servers|https://github.com/kewlfft/opennic-up|{{AUR|opennic-up}}}}
  
static domain_name_servers=8.8.4.4 8.8.8.8
+
{{Expansion|Add [[cloudflared]]?}}
  
=== Write-protect /etc/resolv.conf ===
+
== DNS servers ==
  
Another way to protect your {{ic|/etc/resolv.conf}} from being modified by anything is setting the immutable (write-protection) attribute:
+
[[DNS]] servers can be [[Wikipedia:Authoritative name server|authoritative]] and [[Wikipedia:Name server#Recursive query|recursive]]. If they are neither, they are called '''stub resolvers''' and simply forward all queries to another recursive name server. Stub resolvers are typically used to introduce DNS caching on the local host or network. Note that the same can also be achieved with a fully-fledged name server. This section compares the available DNS servers, for a more detailed comparison, refer to [[Wikipedia:Comparison of DNS server software]].
  
  # chattr +i /etc/resolv.conf
+
{{Expansion|Fill in the unknowns.}}
 +
 
 +
{| class="wikitable sortable" style="text-align:center"
 +
! rowspan=2 | Name !! rowspan=2 | Package !! colspan=4 | Capabilities !! rowspan=2 | [[resolvconf]] !! colspan=4 | Supported protocols
 +
|-
 +
! [[Wikipedia:Authoritative name server|Authoritative]] !! [[Wikipedia:Name server#Recursive query|Recursive]] !! [[Wikipedia:Name server#Caching name server|Cache]] !! [[Wikipedia:Domain Name System Security Extensions#The lookup procedure|Validates]]<br>[[DNSSEC]]  !! [[Wikipedia:Domain Name System|DNS]] !! [[Wikipedia:DNSCrypt|DNSCrypt]] !! [[Wikipedia:DNS over TLS|DNS<br>over TLS]] !! [[Wikipedia:DNS over HTTPS|DNS<br>over HTTPS]]
 +
|-
 +
! [[dnscrypt-proxy]]
 +
| {{Pkg|dnscrypt-proxy}} || {{No}} || {{No}} || {{Yes}} || {{No}} || {{No}} || {{Y|Server}} || {{Y|Resolver}} || {{No}} || {{Yes}}
 +
|-
 +
! [[Rescached]]
 +
| {{AUR|rescached-git}} || {{No}} || {{No}} || {{Yes}} || {{No}} || {{Yes|https://github.com/shuLhan/rescached-go#integration-with-openresolv}} || {{Yes}} || {{No}} || {{No}} || {{Y|Limited}}<sup>1</sup>
 +
|-
 +
! [[Stubby]]
 +
| {{Pkg|stubby}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{No}} || {{Y|Server}} || {{No}} || {{Y|Resolver}} || {{No}}
 +
|-
 +
!style="white-space: nowrap;"| [[systemd-resolved]]
 +
| {{Pkg|systemd}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{G|[[systemd-resolvconf|Yes]]}} || {{Y|Resolver and [https://github.com/systemd/systemd/issues/4621#issuecomment-260050033 limited server]}} || {{No}} || {{Yes}} || {{No|https://github.com/systemd/systemd/issues/8639}}
 +
|-
 +
! [[dnsmasq]]
 +
| {{Pkg|dnsmasq}} || {{Y|Partial}}<sup>2</sup> || {{No}} || {{Yes}} || {{Yes}} || {{G|[[openresolv#Subscribers|Yes]]}} || {{Yes}} || {{No}} || {{No|http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2018q2/012131.html}} || {{No}}
 +
|-
 +
! [[BIND]]
 +
| {{Pkg|bind}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{G|[[openresolv#Subscribers|Yes]]}} || {{Yes}} || {{No}} || {{Y|[[stunnel#DNS over TLS]]}}|| {{No}}
 +
|-
 +
! [[Knot Resolver]]
 +
| {{AUR|knot-resolver}} || {{No}} || {{Yes}} || {{Yes}} || {{Yes}} || {{No}} || {{Yes}} || {{No}} || {{Yes}} || {{Y|[https://knot-resolver.readthedocs.io/en/stable/modules-http-doh.html Server]}}
 +
|-
 +
! [[Wikipedia:MaraDNS|MaraDNS]]
 +
| {{AUR|maradns}} || {{Yes}} || {{Yes}} || {{Yes}} || {{No}} || {{No}} || {{Yes}} || {{No}} || {{No}} || {{No}}
 +
|-
 +
! [[pdnsd]]
 +
| {{Pkg|pdnsd}} || {{Yes}} || {{Yes}} || {{G|Permanent}} || {{No}} || {{G|[[openresolv#Subscribers|Yes]]}} || {{Yes}} || {{No}} || {{No}} || {{No}}
 +
|-
 +
! [[Wikipedia:PowerDNS#Recursor|PowerDNS Recursor]]
 +
| {{Pkg|powerdns-recursor}} || {{No}} || {{Yes}} || {{Yes}} || {{Yes}} || {{G|[[openresolv#Subscribers|Yes]]}} || {{Yes}} || {{No}} || {{No}} || {{No}}
 +
|-
 +
! [[Unbound]]
 +
| {{Pkg|unbound}} || {{Y|Partial}} || {{Yes}} || {{Yes}} || {{Yes}} || {{G|[[openresolv#Subscribers|Yes]]}} || {{Yes}} || {{Y|Server}} || {{Yes}} || {{No|1=https://nlnetlabs.nl/bugs-script/show_bug.cgi?id=1200}}
 +
|-
 +
! [https://maradns.samiam.org/deadwood/ Deadwood]
 +
| {{AUR|deadwood}} || ? || ? || ? || ? || ? || ? || ? || ? || ?
 +
|-
 +
! [https://coredns.io/ CoreDNS]
 +
| {{AUR|coredns}} or {{AUR|coredns-bin}} || ? || ? || ? || ? || ? || ? || ? || ? || ?
 +
|}
 +
 
 +
# Only forwards using DNS over HTTPS when Rescached itself is queried using DNS over HTTPS.[https://github.com/shuLhan/rescached-go#integration-with-dns-over-https]
 +
# From [[Wikipedia:Comparison of DNS server software#cite_note-masqauth-28|Wikipedia]]: dnsmasq has limited authoritative support, intended for internal network use rather than public Internet use.
 +
 
 +
=== Authoritative-only servers ===
 +
 
 +
{| class="wikitable sortable" style="text-align:center"
 +
! Name !! Package !!  [[DNSSEC]] !! Geographic<br>balancing
 +
|-
 +
! gdnsd
 +
| {{Pkg|gdnsd}} || {{No}} || {{Yes}}
 +
|-
 +
! [[Wikipedia:Knot DNS|Knot DNS]]
 +
| {{Pkg|knot}} || {{Yes}} || {{Yes|https://www.knot-dns.cz/docs/2.7/singlehtml/#geoip-geography-based-responses}}
 +
|-
 +
! [[NSD]]
 +
| {{Pkg|nsd}} || {{No}} || {{No}}
 +
|-
 +
! [[PowerDNS]]
 +
| {{Pkg|powerdns}} || {{Yes}} || {{Yes}}
 +
|}
 +
 
 +
=== Conditional forwarding ===
 +
 
 +
{{Remove|Pointless section, there is no software list or instructions.|section=Template remove of Conditional forwarding}}
 +
 
 +
It is possible to use specific DNS resolvers when querying specific domain names. This is particularly useful when connecting to a VPN, so that queries to the VPN network are resolved by the VPN's DNS, while queries to the internet will still be resolved by your standard DNS resolver. It can also be used on local networks.
 +
 
 +
To implement it, you need to use a [[#DNS servers|local resolver]] because glibc does not support it.
 +
 
 +
In a dynamic environment (laptops and to some extents desktops), you need to configure your resolver based on the network(s) you are connected to. The best way to do that is to use [[openresolv]] because it supports [[openresolv#Subscribers|multiple subscribers]]. Some [[network manager]]s support it, either through openresolv, or by configuring the resolver directly.
 +
 
 +
==== Software combination support ====
 +
 
 +
===== openresolv user support =====
 +
 
 +
{{Merge|openresolv#Users|There already is a list of software that supports ''resolvconf''.}}
 +
 
 +
{| class="wikitable sortable"
 +
|+ DHCP Clients
 +
! Software !! Support ?
 +
|-
 +
| [[dhcpcd]] || Unknown
 +
|-
 +
| [[iwd]] || Unknown
 +
|}
 +
 
 +
{| class="wikitable sortable"
 +
|+ Network managers
 +
! Software !! Support ?
 +
|-
 +
| [[NetworkManager]] || {{Y|Partial}}
 +
|-
 +
| [[netctl]] || Unknown
 +
|}
 +
 
 +
{| class="wikitable sortable"
 +
|+ VPN Clients
 +
! Software !! Support ?
 +
|-
 +
| [[OpenConnect]] || Unknown
 +
|-
 +
| [[OpenVPN]] || Unknown
 +
|-
 +
| [[strongSwan]] || Unknown
 +
|-
 +
| [[WireGuard]] || Unknown
 +
|}
 +
 
 +
===== openresolv subscriber support =====
 +
 
 +
{{Merge|openresolv#Subscribers|Duplicates existing content.}}
 +
 
 +
{| class="wikitable sortable"
 +
! Software !! Support ?
 +
|-
 +
| [[BIND]] || Unknown
 +
|-
 +
| [[dnsmasq]] || {{Yes}}
 +
|-
 +
| [[pdnsd]] || Unknown
 +
|-
 +
| {{Pkg|powerdns-recursor}} || Unknown
 +
|-
 +
| [[Unbound]] || Unknown
 +
|}
 +
 
 +
===== Other solutions =====
 +
 
 +
NetworkManager [[NetworkManager#DNS caching and conditional forwarding|supports conditional forwarding without openresolv]].
  
=== Use timeout option to reduce hostname lookup time ===
+
{{Note|Although you could use other conditions for forwarding (for example, source IP address), "conditional forwarding" appears to be the name used for the "domain queried" condition.}}
  
If you are confronted with a very long hostname lookup (may it be in [[pacman]] or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in {{ic|/etc/resolv.conf}}.
+
== See also ==
  
options timeout:1
+
* [https://www.tldp.org/LDP/nag2/x-087-2-resolv.html Linux Network Administrators Guide]
 +
* [https://www.debian.org/doc/manuals/debian-handbook/sect.hostname-name-service.en.html#sect.name-resolution Debian Handbook]
 +
* [[RFC:7706]] - Decreasing Access Time to Root Servers by Running One on Loopback
 +
* [http://linux-ip.net/pages/diagrams.html#domain-name-system-overview Domain name system overview] - Diagram about DNS
 +
* [[Alternative DNS services]]

Latest revision as of 13:22, 1 April 2020

In general, a domain name represents an IP address and is associated to it in the Domain Name System (DNS). This article explains how to configure domain name resolution and resolve domain names.

Name Service Switch

Tango-view-fullscreen.pngThis article or section needs expansion.Tango-view-fullscreen.png

Reason: Mention nss-mdns, nss-tls-gitAUR and others. (Discuss in Talk:Domain name resolution#)

The Name Service Switch (NSS) facility is part of the GNU C Library (glibc) and backs the getaddrinfo(3) API, used to resolve domain names. NSS allows system databases to be provided by separate services, whose search order can be configured by the administrator in nsswitch.conf(5). The database responsible for domain name resolution is the hosts database, for which glibc offers the following services:

Systemd provides three NSS services for hostname resolution:

Resolve a domain name using NSS

NSS databases can be queried with getent(1). A domain name can be resolved through NSS using:

$ getent hosts domain_name
Note: While most programs resolve domain names using NSS, some may read /etc/resolv.conf and/or /etc/hosts directly. See Network configuration#Local hostname resolution.

Glibc resolver

The glibc resolver reads /etc/resolv.conf for every resolution to determine the nameservers and options to use.

resolv.conf(5) lists nameservers together with some configuration options. Nameservers listed first are tried first, up to three nameservers may be listed. Lines starting with a number sign (#) are ignored.

Note: The glibc resolver does not cache queries. To improve query lookup time you can set up a caching resolver. Glibc resolver also can not validate DNSSEC. A DNSSEC capable validator resolver is required for that one. See #DNS servers for more information.

Overwriting of /etc/resolv.conf

Network managers tend to overwrite /etc/resolv.conf, for specifics see the corresponding section:

To prevent programs from overwriting /etc/resolv.conf, it is also possible to write-protect it by setting the immutable file attribute:

# chattr +i /etc/resolv.conf
Tip: If you want multiple processes to write to /etc/resolv.conf, you can use resolvconf.

Limit lookup time

If you are confronted with a very long hostname lookup (may it be in pacman or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in /etc/resolv.conf.

options timeout:1

Hostname lookup delayed with IPv6

If you experience a 5 second delay when resolving hostnames it might be due to a DNS-server/Firewall misbehaving and only giving one reply to a parallel A and AAAA request.[1] You can fix that by setting the following option in /etc/resolv.conf:

options single-request

Local domain names

To be able to use the hostname of local machine names without the fully qualified domain name, add a line to /etc/resolv.conf with the local domain such as:

domain example.org

That way you can refer to local hosts such as mainmachine1.example.org as simply mainmachine1 when using the ssh command, but the drill command still requires the fully qualified domain names in order to perform lookups.

Lookup utilities

To query specific DNS servers and DNS/DNSSEC records you can use dedicated DNS lookup utilities. These tools implement DNS themselves and do not use NSS.

  • ldns provides drill(1), which is a tool designed to retrieve information out of the DNS.

For example, to query a specific nameserver with drill for the TXT records of a domain:

$ drill @nameserver TXT domain

Unless a DNS server is specified, drill will use the nameservers defined in /etc/resolv.conf.

Tip: Some DNS servers ship with their own DNS lookup utilities. E.g. knot has khost(1) and kdig(1), Unboundunbound-host(1).

Resolver performance

The Glibc resolver does not cache queries. To implement local caching, use systemd-resolved or set up a local caching DNS server and use it as the name server by setting 127.0.0.1 and ::1 as the name servers in /etc/resolv.conf or in /etc/resolvconf.conf if using openresolv.

Tip:
  • The drill or dig lookup utilities report the query time.
  • A router usually sets its own caching resolver as the network's DNS server thus providing DNS cache for the whole network.
  • If it takes too long to switch to the next DNS server you can try decreasing the timeout.

Privacy and security

The DNS protocol is unencrypted and does not account for confidentiality, integrity or authentication, so if you use an untrusted network or a malicious ISP, your DNS queries can be eavesdropped and the responses manipulated. Furthermore, DNS servers can conduct DNS hijacking.

You need to trust your DNS server to treat your queries confidentially. DNS servers are provided by ISPs and third-parties. Alternatively you can run your own recursive name server, which however takes more effort. If you use a DHCP client in untrusted networks, be sure to set static name servers to avoid using and being subject to arbitrary DNS servers. To secure your communication with a remote DNS server you can use an encrypted protocol, like DNS over TLS (RFC 7858), DNS over HTTPS (RFC 8484), or DNSCrypt, provided that both the upstream server and your resolver support the protocol. An alternative can be a dedicated software to encrypt and decrypt the communication, such as stunnel. To verify that responses are actually from authoritative name servers, you can validate DNSSEC, provided that both the upstream server(s) and your resolver support it.

Application-level DNS

Be aware that some client software, such as major web browsers[2][3], are starting to implement DNS over HTTPS. While the encryption of queries may often be seen as a bonus, it also means the software sidetracks queries around the system resolver configuration.[4]

Mozilla has proposed disabling application-level DNS if the system resolver cannot resolve the domain "use-application-dns.net". Currently this check is only implemented in Firefox.

Tango-view-fullscreen.pngThis article or section needs expansion.Tango-view-fullscreen.png

Reason: Explain why is it necessary or what are the benefits of configuring DNS over HTTPS in web browsers over running a stub resolver. (Discuss in Talk:Domain name resolution#)

Configuring DNS over HTTPS in Firefox

In order to configure DNS over HTTPS in Firefox (based on [5]):

  1. open Network Settings in Preferences
  2. click Settings
  3. check Enable DNS over HTTPS

Third-party DNS services

Note: Before using a third-party DNS service, check its privacy policy for information on how user data is handled. User data has value and can be sold to other parties.

There are various third-party DNS services available, some of which also have dedicated software:

  • dingo — A DNS client for Google DNS over HTTPS
https://github.com/pforemski/dingo || dingo-gitAUR
  • opennic-up — Automates the renewal of the DNS servers with the most responsive OpenNIC servers
https://github.com/kewlfft/opennic-up || opennic-upAUR

Tango-view-fullscreen.pngThis article or section needs expansion.Tango-view-fullscreen.png

Reason: Add cloudflared? (Discuss in Talk:Domain name resolution#)

DNS servers

DNS servers can be authoritative and recursive. If they are neither, they are called stub resolvers and simply forward all queries to another recursive name server. Stub resolvers are typically used to introduce DNS caching on the local host or network. Note that the same can also be achieved with a fully-fledged name server. This section compares the available DNS servers, for a more detailed comparison, refer to Wikipedia:Comparison of DNS server software.

Tango-view-fullscreen.pngThis article or section needs expansion.Tango-view-fullscreen.png

Reason: Fill in the unknowns. (Discuss in Talk:Domain name resolution#)
Name Package Capabilities resolvconf Supported protocols
Authoritative Recursive Cache Validates
DNSSEC
DNS DNSCrypt DNS
over TLS
DNS
over HTTPS
dnscrypt-proxy dnscrypt-proxy No No Yes No No Server Resolver No Yes
Rescached rescached-gitAUR No No Yes No Yes Yes No No Limited1
Stubby stubby No No No Yes No Server No Resolver No
systemd-resolved systemd No No Yes Yes Yes Resolver and limited server No Yes No
dnsmasq dnsmasq Partial2 No Yes Yes Yes Yes No No No
BIND bind Yes Yes Yes Yes Yes Yes No stunnel#DNS over TLS No
Knot Resolver knot-resolverAUR No Yes Yes Yes No Yes No Yes Server
MaraDNS maradnsAUR Yes Yes Yes No No Yes No No No
pdnsd pdnsd Yes Yes Permanent No Yes Yes No No No
PowerDNS Recursor powerdns-recursor No Yes Yes Yes Yes Yes No No No
Unbound unbound Partial Yes Yes Yes Yes Yes Server Yes No
Deadwood deadwoodAUR ? ? ? ? ? ? ? ? ?
CoreDNS corednsAUR or coredns-binAUR ? ? ? ? ? ? ? ? ?
  1. Only forwards using DNS over HTTPS when Rescached itself is queried using DNS over HTTPS.[6]
  2. From Wikipedia: dnsmasq has limited authoritative support, intended for internal network use rather than public Internet use.

Authoritative-only servers

Name Package DNSSEC Geographic
balancing
gdnsd gdnsd No Yes
Knot DNS knot Yes Yes
NSD nsd No No
PowerDNS powerdns Yes Yes

Conditional forwarding

Tango-edit-cut.pngThis section is being considered for removal.Tango-edit-cut.png

Reason: Pointless section, there is no software list or instructions. (Discuss in Talk:Domain name resolution#Template remove of Conditional forwarding)

It is possible to use specific DNS resolvers when querying specific domain names. This is particularly useful when connecting to a VPN, so that queries to the VPN network are resolved by the VPN's DNS, while queries to the internet will still be resolved by your standard DNS resolver. It can also be used on local networks.

To implement it, you need to use a local resolver because glibc does not support it.

In a dynamic environment (laptops and to some extents desktops), you need to configure your resolver based on the network(s) you are connected to. The best way to do that is to use openresolv because it supports multiple subscribers. Some network managers support it, either through openresolv, or by configuring the resolver directly.

Software combination support

openresolv user support

Merge-arrows-2.pngThis article or section is a candidate for merging with openresolv#Users.Merge-arrows-2.png

Notes: There already is a list of software that supports resolvconf. (Discuss in Talk:Domain name resolution#)
DHCP Clients
Software Support ?
dhcpcd Unknown
iwd Unknown
Network managers
Software Support ?
NetworkManager Partial
netctl Unknown
VPN Clients
Software Support ?
OpenConnect Unknown
OpenVPN Unknown
strongSwan Unknown
WireGuard Unknown
openresolv subscriber support

Merge-arrows-2.pngThis article or section is a candidate for merging with openresolv#Subscribers.Merge-arrows-2.png

Notes: Duplicates existing content. (Discuss in Talk:Domain name resolution#)
Software Support ?
BIND Unknown
dnsmasq Yes
pdnsd Unknown
powerdns-recursor Unknown
Unbound Unknown
Other solutions

NetworkManager supports conditional forwarding without openresolv.

Note: Although you could use other conditions for forwarding (for example, source IP address), "conditional forwarding" appears to be the name used for the "domain queried" condition.

See also