Difference between revisions of "Domain name resolution"

From ArchWiki
Jump to: navigation, search
m (UncensoredDNS: repetition removed (minor))
m (Name Service Switch: complete the sentence)
 
(150 intermediate revisions by 11 users not shown)
Line 1: Line 1:
{{Lowercase title}}
 
 
[[Category:Domain Name System]]
 
[[Category:Domain Name System]]
 +
[[Category:Network configuration]]
 
[[de:Resolv.conf]]
 
[[de:Resolv.conf]]
 
[[es:Resolv.conf]]
 
[[es:Resolv.conf]]
Line 8: Line 8:
 
[[zh-hans:Resolv.conf]]
 
[[zh-hans:Resolv.conf]]
 
{{Related articles start}}
 
{{Related articles start}}
{{Related|Improving performance#Network}}
+
{{Related|Alternative DNS services}}
 
{{Related articles end}}
 
{{Related articles end}}
 +
This article explains how to configure [[Wikipedia:Domain name|domain name]] resolution and resolve domain names.
  
The configuration file for DNS resolvers is {{ic|/etc/resolv.conf}}. From {{man|5|resolv.conf}}:
+
== Name Service Switch ==
:The resolver is a set of routines in the C library that provide access to the Internet Domain Name System (DNS). The resolver configuration file contains information that is read by the resolver routines the first time they are invoked by a process. The file is designed to be human readable and contains a list of keywords with values that provide various types of resolver information.
+
:''"NSS" redirects here. For Mozilla cryptographic libraries, see [[Network Security Services]].''
  
:If this file does not exist, only the name server on the local machine will be queried; the domain name is determined from the hostname and the domain search path is constructed from the domain name.
+
The [[Wikipedia:Name Service Switch|Name Service Switch]] (NSS) facility is part of the GNU C Library ({{Pkg|glibc}}) and backs the {{man|3|getaddrinfo}} API, used to resolve domain names. NSS allows system databases to be provided by separate services, whose search order can be configured by the administrator in {{man|5|nsswitch.conf}}. The database responsible for domain name resolution is the {{ic|hosts}} database, for which glibc offers the following services:
  
== DNS in Linux ==
+
* {{ic|file}}: reads the {{ic|/etc/hosts}} file, see {{man|5|hosts}}
 +
* {{ic|dns}}: the [[wikipedia:Domain_Name_System|DNS]] resolver which reads {{ic|/etc/resolv.conf}}; see {{man|5|resolv.conf}}, [[#Glibc resolver]] and [[#resolv.conf]]
  
Your ISP (usually) provides working [[wikipedia:Domain_Name_System|DNS]] servers, and a router may also add an extra DNS server in case it has its own cache server. Switching between DNS servers does not represent a problem for Windows users, because if a DNS server is slow or does not work it will immediately switch to a better one.  However, Linux usually takes longer to timeout, which could be the reason why you are getting a delay.
+
[[Systemd]] provides three NSS services for hostname resolution:
  
=== Testing ===
+
* {{man|8|nss-resolve}} - a caching DNS stub resolver, described in [[#Systemd-resolved]]
 +
* {{man|8|nss-myhostname}} - provides hostname resolution without having to edit {{ic|/etc/hosts}}
 +
* {{man|8|nss-mymachines}} - provides hostname resolution for the names of local {{man|8|systemd-machined}} containers
  
Use ''drill'' (provided by package {{Pkg|ldns}}) before any changes, repeat after making the adjustments and compare the query time(s). The following command uses the nameservers set in {{ic|/etc/resolv.conf}}:
+
NSS databases can be queried with {{man|1|getent}}. You can resolve a domain name through NSS using:
$ drill www5.yahoo.com
 
  
You can also specify a specific nameserver's ip address, bypassing the settings in your {{ic|/etc/resolv.conf}}:
+
$ getent hosts ''domain_name''
  
$ drill @''ip.of.name.server'' www5.yahoo.com
+
{{Note|While most programs resolve domain names using NSS, some may read {{ic|resolv.conf}} and/or {{ic|/etc/hosts}} directly. See [[#resolv.conf]] and [[Network configuration#Local hostname resolution]].}}
  
For example to test Google's name servers:
+
== Glibc resolver ==
  
$ drill @8.8.8.8 www5.yahoo.com
+
The glibc DNS resolver reads {{ic|/etc/resolv.conf}} ({{man|5|resolv.conf}}) for every resolution to determine the nameservers and options to use.
  
To test a local name server (such as [[unbound]]) do:
+
Nameservers listed first are tried first, up to three nameservers may be listed. Lines starting with a number sign are ignored.
  
$ drill @127.0.0.1 www5.yahoo.com
+
{{Note|The glibc resolver does not cache queries. See [[#Performance]] for more information.}}
  
== Alternative DNS servers ==
+
=== Limit lookup time ===
  
To use alternative DNS servers, edit {{ic|/etc/resolv.conf}} and add them at the top of the list so they are used first, optionally removing or commenting out other servers. Currently, you may include a maximum of three nameservers.  
+
If you are confronted with a very long hostname lookup (may it be in [[pacman]] or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in {{ic|/etc/resolv.conf}}.
  
{{Note|Changes made to {{ic|/etc/resolv.conf}} take effect immediately.}}
+
options timeout:1
  
{{Tip|If you require more flexibility, e.g. more than three nameservers, you can use a local DNS resolver like [[dnsmasq]] or [[unbound]]. In this case the nameserver IP address will likely be {{ic|127.0.0.1}}.}}
+
=== Hostname lookup delayed with IPv6 ===
  
=== OpenNIC ===
+
If you experience a 5 second delay when resolving hostnames it might be due to a DNS-server/Firewall misbehaving and only giving one reply to a parallel A and AAAA request ([http://udrepper.livejournal.com/20948.html source]).
 +
You can fix that by setting the following option in {{ic|/etc/resolv.conf}}:
  
[http://www.opennicproject.org/ OpenNIC] provides free uncensored nameservers with additional features.
+
options single-request
  
{{Tip|OpenNIC offers many [https://servers.opennic.org/ different nameservers] located in multiple countries. Pick some of the [https://www.opennic.org/ nearest nameservers] for optimal performance. Alternatively, the anycast servers below can be used; while reliable their latency [https://wiki.opennic.org/opennic/dont_anycast fluctuates a lot]. }}
+
=== Local domain names ===
  
# OpenNIC IPv4 nameservers (Worldwide Anycast)
+
If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to {{ic|resolv.conf}} with the local domain such as:
nameserver 185.121.177.177
 
nameserver 185.121.177.53
 
  
  # OpenNIC IPv6 nameservers (Worldwide Anycast)
+
  domain example.com
nameserver 2a05:dfc7:5::53
 
nameserver 2a05:dfc7:5::5353
 
  
=== Cisco Umbrella (formerly OpenDNS) ===
+
That way you can refer to local hosts such as {{ic|mainmachine1.example.com}} as simply {{ic|mainmachine1}} when using the ''ssh'' command, but the ''drill'' command still requires the fully qualified domain names in order to perform lookups.
 
 
[https://www.opendns.com/home-internet-security/ OpenDNS] provided free alternative nameservers, was [https://umbrella.cisco.com/products/features/opendns-cisco-umbrella bought by Cisco in Nov. 2016] and continues to offer OpenDNS as end-user product of its "Umbrella" product suite with focus on Security Enforcement, Security Intelligence and Web Filtering.
 
The old nameservers [https://www.opendns.com/setupguide/ still work] but are [https://www.opendns.com/home-internet-security/ pre-configured to block adult content]:
 
 
 
# OpenDNS IPv4 nameservers
 
nameserver 208.67.222.222
 
nameserver 208.67.220.220
 
 
 
# OpenDNS IPv6 nameservers
 
nameserver 2620:0:ccc::2
 
nameserver 2620:0:ccd::2
 
 
 
=== Google ===
 
 
 
[https://developers.google.com/speed/public-dns/ Google's nameservers] can be used as an alternative:
 
 
 
# Google IPv4 nameservers
 
nameserver 8.8.8.8
 
nameserver 8.8.4.4
 
 
 
# Google IPv6 nameservers
 
nameserver 2001:4860:4860::8888
 
nameserver 2001:4860:4860::8844
 
 
 
=== Comodo ===
 
[http://securedns.dnsbycomodo.com/ Comodo] provides another IPv4 set, with optional (non-free) web-filtering. Implied in this feature is that the service hijacks the queries.
 
 
 
# Comodo nameservers
 
nameserver 8.26.56.26
 
nameserver 8.20.247.20
 
  
=== Yandex ===
+
== Systemd-resolved ==
[https://dns.yandex.com/advanced/ Yandex.DNS] have three options:
 
  
# Basic Yandex.DNS - Quick and reliable DNS
+
{{man|8|systemd-resolved}} is a [[systemd]] service that provides network name resolution to local applications via a [[D-Bus]] interface, the {{ic|resolve}} NSS service ({{man|8|nss-resolve}}), and a local DNS stub listener on {{ic|127.0.0.53}}.  
nameserver 77.88.8.8              # Preferred IPv4 DNS
 
nameserver 77.88.8.1              # Alternate IPv4 DNS
 
 
nameserver 2a02:6b8::feed:0ff    # Preferred IPv6 DNS
 
nameserver 2a02:6b8:0:1::feed:0ff # Alternate IPv6 DNS
 
  
# Safe Yandex.DNS - Protection from virus and fraudulent content
+
''systemd-resolved'' has four different modes for handling ''resolv.conf'' (described in {{man|8|systemd-resolved|/ETC/RESOLV.CONF}}). We will focus here on the two most relevant modes.
nameserver 77.88.8.88            # Preferred IPv4 DNS
 
nameserver 77.88.8.2              # Alternate IPv4 DNS
 
 
nameserver 2a02:6b8::feed:bad    # Preferred IPv6 DNS
 
nameserver 2a02:6b8:0:1::feed:bad # Alternate IPv6 DNS
 
  
# Family Yandex.DNS - Without adult content
+
# The mode in which ''systemd-resolved'' is a client of the {{ic|/etc/resolv.conf}}. This mode preserves {{ic|/etc/resolv.conf}} and is '''compatible''' with the procedures described in this page.
nameserver 77.88.8.7              # Preferred IPv4 DNS
+
# The ''systemd-resolved'''s '''recommended''' mode of operation: the DNS stub file as indicated below contains both the local stub {{ic|127.0.0.53}} as the only DNS servers and a list of search domains.
nameserver 77.88.8.3              # Alternate IPv4 DNS
 
 
nameserver 2a02:6b8::feed:a11    # Preferred IPv6 DNS
 
nameserver 2a02:6b8:0:1::feed:a11 # Alternate IPv6 DNS
 
  
Yandex.DNS' speed is the same in all three modes. In "Basic" mode, there is no traffic filtering. In "Safe" mode, protection from infected and fraudulent sites is provided. "Family" mode enables protection from dangerous sites and blocks sites with adult content.
+
{{hc|/run/systemd/resolve/stub-resolv.conf|
 +
nameserver 127.0.0.53
 +
search lan
 +
}}
  
=== UncensoredDNS ===
+
The service users are advised to redirect the {{ic|/etc/resolv.conf}} file to the local stub DNS resolver file {{ic|/run/systemd/resolve/stub-resolv.conf}} managed by ''systemd-resolved''. This propagates the systemd managed configuration to all the clients. This can be done by deleting or renaming the existing {{ic|/etc/resolv.conf}} and replacing it by a symbolic link to the systemd stub:
  
[http://censurfridns.dk UncensoredDNS] is a free uncensored DNS resolver which also answers queries on port 5353 if you are behind a firewall blocking outgoing port 53. It is run by a private individual and consists in one anycast served by multiple servers and one unicast node hosted in Denmark.
+
# ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
  
# censurfridns.dk IPv4 nameservers
+
In this mode, the DNS servers are provided in the {{man|5|resolved.conf}} file:
nameserver 91.239.100.100    ## anycast.censurfridns.dk
 
nameserver 89.233.43.71      ## unicast.censurfridns.dk
 
  
# censurfridns.dk IPv6 nameservers
+
{{hc|/etc/systemd/resolved.conf|2=
  nameserver 2001:67c:28a4::  ## anycast.censurfridns.dk
+
  [Resolve]
nameserver 2a01:3a0:53:53::  ## unicast.censurfridns.dk
+
'''DNS=91.239.100.100 89.233.43.71'''
 +
...
 +
}}
  
== Preserve DNS settings ==
+
In order to check the DNS actually used by ''systemd-resolved'', the command to use is:
  
[[dhcpcd]], [[netctl]], [[NetworkManager]], and various other processes can overwrite {{ic|/etc/resolv.conf}}. This is usually desirable behavior, but sometimes DNS settings need to be set manually (e.g. when using a static IP address). There are several ways to accomplish this.
+
$ systemd-resolve --status
*If you are using ''dhcpcd'', see [[#Modify the dhcpcd config]] below.
 
*If you are using [[netctl]] and static IP address assignment, do not use the {{ic|DNS*}} options in your profile, otherwise ''resolvconf'' is called and {{ic|/etc/resolv.conf}} overwritten.
 
  
=== With NetworkManager===
+
{{Tip|
 +
* To understand the context around the DNS choices and switches, one can turn on detailed debug information for ''systemd-resolved'' as described in [[Systemd#Diagnosing a service]].
 +
* The mode of operation of ''systemd-resolved'' is detected automatically, depending on whether {{ic|/etc/resolv.conf}} is a symlink to the local stub DNS resolver file or contains server names.
 +
}}
  
To stop NetworkManager from modifying {{ic|/etc/resolv.conf}}, edit {{ic|/etc/NetworkManager/NetworkManager.conf}} and add the following in the {{ic|[main]}} section:
+
== resolv.conf ==
  
dns=none
+
{{Merge|#Glibc resolver|Both sections describe the same thing.}}
  
{{ic|/etc/resolv.conf}} might be a broken symlink that you will need to remove after doing that. Then, just create a new {{ic|/etc/resolv.conf}} file.
+
{{ic|/etc/resolv.conf}} is the configuration file of the [[#Glibc resolver]] and is also used by [[#Systemd-resolved]].
  
=== Using openresolv ===
+
To find out how a [[network manager]] handles {{ic|resolv.conf}} consult its corresponding section:
  
{{Pkg|openresolv}} provides a utility ''resolvconf'', which is a framework for managing multiple DNS configurations. See {{man|8|resolvconf}} and {{man|5|resolvconf.conf}} for more information.
+
* [[dhcpcd#resolv.conf]]
 +
* [[netctl#resolv.conf]]
 +
* [[NetworkManager#resolv.conf]]
  
The configuration is done in {{ic|/etc/resolvconf.conf}} and running {{ic|resolvconf -u}} will generate {{ic|/etc/resolv.conf}}.
+
To prevent programs from overwriting {{ic|resolv.conf}} you can also write-protect it by setting the immutable [[file attribute]].
  
=== Modify the dhcpcd config ===
+
{{Tip|If you want multiple processes to write to {{ic|resolv.conf}}, you can use [[openresolv]].}}
  
''dhcpcd'''s configuration file may be edited to prevent the ''dhcpcd'' daemon from overwriting {{ic|/etc/resolv.conf}}. To do this, add the following to the last section of {{ic|/etc/dhcpcd.conf}}:
+
== Performance ==
  
nohook resolv.conf
+
The [[#Glibc resolver]] does not cache queries. If you want local caching use [[#Systemd-resolved]] or set up a local caching [[DNS server]].
  
Alternatively, you can create a file called {{ic|/etc/resolv.conf.head}} containing your DNS servers. ''dhcpcd'' will prepend this file to the beginning of {{ic|/etc/resolv.conf}}.
+
{{Tip|The ''dig'' and ''drill'' [[#Lookup utilities]] report the query time.}}
  
Or you can configure dhcpcd to use the same DNS servers every time. To do this, add the following line at the end of your {{ic|/etc/dhcpcd.conf}}, where {{ic|''dns-server-ip-addressses''}} is a space separated list of DNS IP addresses.
+
Internet service providers usually provide working DNS servers. A router may also add an extra DNS server in case it has its own cache server. Switching between DNS servers is transparent for Windows users, because if a DNS server is slow or does not work it will immediately switch to a better one. However, Linux usually takes longer to timeout, which could cause delays.
  
static domain_name_servers=''dns-server-ip-addresses''
+
== Lookup utilities ==
  
For example, to set it to Google's DNS servers:
+
To query specific DNS servers and DNS/[[DNSSEC]] records you can use a DNS lookup utility.
  
static domain_name_servers=8.8.8.8 8.8.4.4
+
* {{Pkg|bind-tools}} provides {{man|1|dig}}, {{man|1|host}}, {{man|1|nslookup}} and a bunch of {{ic|dnssec-}} tools.
 +
* {{Pkg|ldns}} provides {{man|1|drill}}, which is similar to ''dig''
  
=== Write-protect /etc/resolv.conf ===
+
For example, to query a specific nameserver with drill for the TXT records of a domain:
  
Another way to protect your {{ic|/etc/resolv.conf}} from being modified by anything is setting the immutable (write-protection) attribute:
+
$ drill @''nameserver'' TXT ''domain''
  
# chattr +i /etc/resolv.conf
+
{{Accuracy|Are these utilities examples of programs which don't use the NSS?}}
  
=== Use timeout option to reduce hostname lookup time ===
+
If you do not specify a DNS server ''dig'' and ''drill'' use the nameservers defined in {{ic|/etc/resolv.conf}}.
  
If you are confronted with a very long hostname lookup (may it be in [[pacman]] or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in {{ic|/etc/resolv.conf}}.
+
== See also ==
  
options timeout:1
+
* [https://www.tldp.org/LDP/nag2/x-087-2-resolv.html Linux Network Administrators Guide]
 
+
* [https://www.debian.org/doc/manuals/debian-handbook/sect.hostname-name-service.en.html#sect.name-resolution Debian Handbook]
== Tips and tricks ==
 
 
 
=== Local domain names ===
 
 
 
If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to {{ic|resolv.conf}} with the local domain such as:
 
 
 
domain example.com
 
 
 
That way you can refer to local hosts such as {{ic|mainmachine1.example.com}} as simply {{ic|mainmachine1}} when using the ''ssh'' command, but the ''drill'' command still requires the fully qualified domain names in order to perform lookups.
 

Latest revision as of 19:31, 23 May 2018

This article explains how to configure domain name resolution and resolve domain names.

Name Service Switch

"NSS" redirects here. For Mozilla cryptographic libraries, see Network Security Services.

The Name Service Switch (NSS) facility is part of the GNU C Library (glibc) and backs the getaddrinfo(3) API, used to resolve domain names. NSS allows system databases to be provided by separate services, whose search order can be configured by the administrator in nsswitch.conf(5). The database responsible for domain name resolution is the hosts database, for which glibc offers the following services:

Systemd provides three NSS services for hostname resolution:

NSS databases can be queried with getent(1). You can resolve a domain name through NSS using:

$ getent hosts domain_name
Note: While most programs resolve domain names using NSS, some may read resolv.conf and/or /etc/hosts directly. See #resolv.conf and Network configuration#Local hostname resolution.

Glibc resolver

The glibc DNS resolver reads /etc/resolv.conf (resolv.conf(5)) for every resolution to determine the nameservers and options to use.

Nameservers listed first are tried first, up to three nameservers may be listed. Lines starting with a number sign are ignored.

Note: The glibc resolver does not cache queries. See #Performance for more information.

Limit lookup time

If you are confronted with a very long hostname lookup (may it be in pacman or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in /etc/resolv.conf.

options timeout:1

Hostname lookup delayed with IPv6

If you experience a 5 second delay when resolving hostnames it might be due to a DNS-server/Firewall misbehaving and only giving one reply to a parallel A and AAAA request (source). You can fix that by setting the following option in /etc/resolv.conf:

options single-request

Local domain names

If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to resolv.conf with the local domain such as:

domain example.com

That way you can refer to local hosts such as mainmachine1.example.com as simply mainmachine1 when using the ssh command, but the drill command still requires the fully qualified domain names in order to perform lookups.

Systemd-resolved

systemd-resolved(8) is a systemd service that provides network name resolution to local applications via a D-Bus interface, the resolve NSS service (nss-resolve(8)), and a local DNS stub listener on 127.0.0.53.

systemd-resolved has four different modes for handling resolv.conf (described in systemd-resolved(8)). We will focus here on the two most relevant modes.

  1. The mode in which systemd-resolved is a client of the /etc/resolv.conf. This mode preserves /etc/resolv.conf and is compatible with the procedures described in this page.
  2. The systemd-resolved's recommended mode of operation: the DNS stub file as indicated below contains both the local stub 127.0.0.53 as the only DNS servers and a list of search domains.
/run/systemd/resolve/stub-resolv.conf
nameserver 127.0.0.53
search lan

The service users are advised to redirect the /etc/resolv.conf file to the local stub DNS resolver file /run/systemd/resolve/stub-resolv.conf managed by systemd-resolved. This propagates the systemd managed configuration to all the clients. This can be done by deleting or renaming the existing /etc/resolv.conf and replacing it by a symbolic link to the systemd stub:

# ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf

In this mode, the DNS servers are provided in the resolved.conf(5) file:

/etc/systemd/resolved.conf
[Resolve]
DNS=91.239.100.100 89.233.43.71
...

In order to check the DNS actually used by systemd-resolved, the command to use is:

$ systemd-resolve --status
Tip:
  • To understand the context around the DNS choices and switches, one can turn on detailed debug information for systemd-resolved as described in Systemd#Diagnosing a service.
  • The mode of operation of systemd-resolved is detected automatically, depending on whether /etc/resolv.conf is a symlink to the local stub DNS resolver file or contains server names.

resolv.conf

Merge-arrows-2.pngThis article or section is a candidate for merging with #Glibc resolver.Merge-arrows-2.png

Notes: Both sections describe the same thing. (Discuss in Talk:Domain name resolution#)

/etc/resolv.conf is the configuration file of the #Glibc resolver and is also used by #Systemd-resolved.

To find out how a network manager handles resolv.conf consult its corresponding section:

To prevent programs from overwriting resolv.conf you can also write-protect it by setting the immutable file attribute.

Tip: If you want multiple processes to write to resolv.conf, you can use openresolv.

Performance

The #Glibc resolver does not cache queries. If you want local caching use #Systemd-resolved or set up a local caching DNS server.

Tip: The dig and drill #Lookup utilities report the query time.

Internet service providers usually provide working DNS servers. A router may also add an extra DNS server in case it has its own cache server. Switching between DNS servers is transparent for Windows users, because if a DNS server is slow or does not work it will immediately switch to a better one. However, Linux usually takes longer to timeout, which could cause delays.

Lookup utilities

To query specific DNS servers and DNS/DNSSEC records you can use a DNS lookup utility.

For example, to query a specific nameserver with drill for the TXT records of a domain:

$ drill @nameserver TXT domain

Tango-inaccurate.pngThe factual accuracy of this article or section is disputed.Tango-inaccurate.png

Reason: Are these utilities examples of programs which don't use the NSS? (Discuss in Talk:Domain name resolution#)

If you do not specify a DNS server dig and drill use the nameservers defined in /etc/resolv.conf.

See also