Difference between revisions of "Domain name resolution"
m (→OpenNIC: link to api wiki)
(→Alternative DNS servers: Added Cloudflare)
|Line 98:||Line 98:|
=== Google ===
=== Google ===
Revision as of 02:53, 2 April 2018
The configuration file for DNS resolvers is
/etc/resolv.conf. From :
- The resolver is a set of routines in the C library that provide access to the Internet Domain Name System (DNS). The resolver configuration file contains information that is read by the resolver routines the first time they are invoked by a process. The file is designed to be human readable and contains a list of keywords with values that provide various types of resolver information.
- If this file does not exist, only the name server on the local machine will be queried; the domain name is determined from the hostname and the domain search path is constructed from the domain name.
- 1 DNS in Linux
- 2 Alternative DNS servers
- 3 Preserve DNS settings
- 4 Tips and tricks
DNS in Linux
ISPs usually provide working DNS servers. A router may also add an extra DNS server in case it has its own cache server. Switching between DNS servers is transparent for Windows users, because if a DNS server is slow or does not work it will immediately switch to a better one. However, Linux usually takes longer to timeout, which could be the reason why you are getting a delay.
Use drill (provided by package
$ drill www.archlinux.org
You can also specify a specific nameserver's ip address, bypassing the settings in your
$ drill @ip.of.name.server www.archlinux.org
For example to test Google's name servers:
$ drill @126.96.36.199 www.archlinux.org
To test a local name server (such as unbound) do:
$ drill @127.0.0.1 www.archlinux.org
Alternative DNS servers
To use alternative DNS servers, edit
/etc/resolv.conf and add them at the top of the list so they are used first, optionally removing or commenting out other servers. Currently, you may include a maximum of three nameservers.
/etc/resolv.conftake effect immediately.
OpenNIC provides free uncensored nameservers located in multiple countries. The full list of public servers is available at servers.opennic.org and a shortlist of nearest nameservers for optimal performance is generated on their home page.
To retrieve a list of nearest nameservers, an API is also available and returns, based on the URL parameters provided, a list of nameservers in the desired format. For example to get the 200 nearest IPv4 servers, one can use https://api.opennicproject.org/geoip/?list&ipv=4&res=200&adm=0&bl&wl.
Alternatively, the anycast servers below can be used; while reliable their latency fluctuates a lot.
# OpenNIC IPv4 nameservers (Worldwide Anycast) nameserver 188.8.131.52 nameserver 184.108.40.206
# OpenNIC IPv6 nameservers (Worldwide Anycast) nameserver 2a05:dfc7:5::53 nameserver 2a05:dfc7:5::5353
DNS.WATCH focuses on neutrality and security and provides two servers located in Germany with no logging and with DNSSEC enabled. Note they welcome commercial sponsorship.
# dns.watch IPv4 nameservers nameserver 220.127.116.11 # resolver1.dns.watch nameserver 18.104.22.168 # resolver2.dns.watch
UncensoredDNS is a free uncensored DNS service. It is run by a private individual and consists in one anycast served by multiple servers and one unicast node hosted in Denmark.
# censurfridns.dk IPv4 nameservers nameserver 22.214.171.124 ## anycast.censurfridns.dk nameserver 126.96.36.199 ## unicast.censurfridns.dk
# censurfridns.dk IPv6 nameservers nameserver 2001:67c:28a4:: ## anycast.censurfridns.dk nameserver 2a01:3a0:53:53:: ## unicast.censurfridns.dk
Cisco Umbrella (formerly OpenDNS)
OpenDNS provided free alternative nameservers, was bought by Cisco in Nov. 2016 and continues to offer OpenDNS as end-user product of its "Umbrella" product suite with focus on Security Enforcement, Security Intelligence and Web Filtering. The old nameservers still work but are pre-configured to block adult content:
# OpenDNS IPv4 nameservers nameserver 188.8.131.52 nameserver 184.108.40.206
# OpenDNS IPv6 nameservers nameserver 2620:0:ccc::2 nameserver 2620:0:ccd::2
Cloudlflare provides a fast service that does not log your activity, to protect your privacy.
# IPv4 nameservers: nameserver 220.127.116.11 nameserver 18.104.22.168
# IPv6 nameservers: nameserver 2606:4700:4700::1111 nameserver 2606:4700:4700::1001
Google's nameservers can be used as an alternative:
# Google IPv4 nameservers nameserver 22.214.171.124 nameserver 126.96.36.199
# Google IPv6 nameservers nameserver 2001:4860:4860::8888 nameserver 2001:4860:4860::8844
Comodo provides another IPv4 set, with optional (non-free) web-filtering. Implied in this feature is that the service hijacks the queries.
# Comodo nameservers nameserver 188.8.131.52 nameserver 184.108.40.206
Yandex.DNS has servers in Russia, Eastern and Western Europe and has three options, Basic, Safe and Family:
# Basic Yandex.DNS - Quick and reliable DNS nameserver 220.127.116.11 # Preferred IPv4 DNS nameserver 18.104.22.168 # Alternate IPv4 DNS nameserver 2a02:6b8::feed:0ff # Preferred IPv6 DNS nameserver 2a02:6b8:0:1::feed:0ff # Alternate IPv6 DNS
# Safe Yandex.DNS - Protection from virus and fraudulent content nameserver 22.214.171.124 # Preferred IPv4 DNS nameserver 126.96.36.199 # Alternate IPv4 DNS nameserver 2a02:6b8::feed:bad # Preferred IPv6 DNS nameserver 2a02:6b8:0:1::feed:bad # Alternate IPv6 DNS
# Family Yandex.DNS - Without adult content nameserver 188.8.131.52 # Preferred IPv4 DNS nameserver 184.108.40.206 # Alternate IPv4 DNS nameserver 2a02:6b8::feed:a11 # Preferred IPv6 DNS nameserver 2a02:6b8:0:1::feed:a11 # Alternate IPv6 DNS
Yandex.DNS' speed is the same in the three modes. In Basic mode, there is no traffic filtering. In Safe mode, protection from infected and fraudulent sites is provided. Family mode enables protection from dangerous sites and blocks sites with adult content.
Quad9 is a free DNS service founded by IBM, Packet Clearing House and Global Cyber Alliance; its primary unique feature is a blocklist which avoids resolving known malicious domains. The addresses below are worldwide anycast.
# Quad9 IPv4 nameservers nameserver 220.127.116.11 ## "secure", with blocklist and DNSSEC nameserver 18.104.22.168 ## no blocklist, no DNSSEC
# Quad9 IPv6 nameservers nameserver 2620:fe::fe ## "secure", with blocklist and DNSSEC nameserver 2620:fe::10 ## no blocklist, no DNSSEC
Preserve DNS settings
dhcpcd, netctl, NetworkManager, and various other processes can overwrite
/etc/resolv.conf. This is usually desirable behavior, but sometimes DNS settings need to be set manually (e.g. when using a static IP address). There are several ways to accomplish this.
- If you are using dhcpcd, see #Modify the dhcpcd config below.
- If you are using netctl and static IP address assignment, do not use the
DNS*options in your profile, otherwise resolvconf is called and
Prevent NetworkManager modifications
To stop NetworkManager from modifying
/etc/NetworkManager/NetworkManager.conf and add the following in the
/etc/resolv.conf might be a broken symlink that you will need to remove after doing that. Then, just create a new
NetworkManager also offers hooks via so called dispatcher scripts that can be used to alter the
/etc/resolv.conf after network changes. See NetworkManager#Network services with NetworkManager dispatcher and for more information.
provides a utility resolvconf, which is a framework for managing multiple DNS configurations. See and for more information.
The configuration is done in
/etc/resolvconf.conf and running
resolvconf -u will generate
Note that NetworkManager can be configured to use openresolv, see NetworkManager#Configure NetworkManager resolv.conf management mode to use resolvconf.
Modify the dhcpcd config
dhcpcd's configuration file may be edited to prevent the dhcpcd daemon from overwriting
/etc/resolv.conf. To do this, add the following to the last section of
Alternatively, you can create a file called
/etc/resolv.conf.head containing your DNS servers. dhcpcd will prepend this file to the beginning of
Or you can configure dhcpcd to use the same DNS servers every time. To do this, add the following line at the end of your
dns-server-ip-addressses is a space separated list of DNS IP addresses.
For example, to set it to Google's DNS servers:
static domain_name_servers=22.214.171.124 126.96.36.199
Another way to protect your
/etc/resolv.conf from being modified by anything is setting the immutable (write-protection) attribute:
# chattr +i /etc/resolv.conf
Tips and tricks
Limit lookup time
If you are confronted with a very long hostname lookup (may it be in pacman or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in
Hostname lookup delayed with IPv6
If you experience a 5 second delay when resolving hostnames it might be due to a DNS-server/Firewall misbehaving and only giving one reply to a parallel A and AAAA request (source).
You can fix that by setting the following option in
Local domain names
If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to
resolv.conf with the local domain such as:
That way you can refer to local hosts such as
mainmachine1.example.com as simply
mainmachine1 when using the ssh command, but the drill command still requires the fully qualified domain names in order to perform lookups.