Difference between revisions of "Domain name resolution"

From ArchWiki
Jump to: navigation, search
(Alternative DNS servers: update Move template)
(Resolvers: link to systemd issue about "strict" mode)
 
(153 intermediate revisions by 9 users not shown)
Line 1: Line 1:
{{Lowercase title}}
 
 
[[Category:Domain Name System]]
 
[[Category:Domain Name System]]
 
[[Category:Network configuration]]
 
[[Category:Network configuration]]
 
[[de:Resolv.conf]]
 
[[de:Resolv.conf]]
[[es:Resolv.conf]]
+
[[es:Domain name resolution]]
 
[[fr:Resolv.conf]]
 
[[fr:Resolv.conf]]
 
[[it:Resolv.conf]]
 
[[it:Resolv.conf]]
 
[[ja:Resolv.conf]]
 
[[ja:Resolv.conf]]
 +
[[pt:Domain name resolution]]
 
[[zh-hans:Resolv.conf]]
 
[[zh-hans:Resolv.conf]]
 
{{Related articles start}}
 
{{Related articles start}}
{{Related|Improving performance#Network}}
+
{{Related|Alternative DNS services}}
 +
{{Related|Network configuration}}
 
{{Related articles end}}
 
{{Related articles end}}
{{Move|DNS configuration|Article should describe nsswitch.conf, resolv.conf, caching DNS servers and utilities like dig & drill.|section=Rewrite}}
+
In general, a [[Wikipedia:Domain name|domain name]] represents an IP address and is associated to it in the [[Wikipedia:Domain Name System|Domain Name System]] (DNS).
 +
This article explains how to configure domain name resolution and resolve domain names.
  
The configuration file for DNS resolvers is {{ic|/etc/resolv.conf}}. From {{man|5|resolv.conf}}:
+
== Name Service Switch ==
:The resolver is a set of routines in the GNU C library ({{Pkg|glibc}}) that provide access to the Domain Name System. The resolver configuration file contains information that is read by the resolver routines the first time they are invoked by a process. The file is designed to be human readable and contains a list of keywords with values that provide various types of resolver information.
 
  
:If this file does not exist, only the name server on the local machine will be queried; the domain name is determined from the hostname and the domain search path is constructed from the domain name.
+
The [[Wikipedia:Name Service Switch|Name Service Switch]] (NSS) facility is part of the GNU C Library ({{Pkg|glibc}}) and backs the {{man|3|getaddrinfo}} API, used to resolve domain names. NSS allows system databases to be provided by separate services, whose search order can be configured by the administrator in {{man|5|nsswitch.conf}}. The database responsible for domain name resolution is the ''hosts'' database, for which glibc offers the following services:
  
To use [[#Alternative DNS servers]], edit {{ic|/etc/resolv.conf}} and add them at the top of the list so they are used first, optionally removing or commenting out other servers. Currently, you may include a maximum of three nameservers.  
+
* ''file'': reads the {{ic|/etc/hosts}} file, see {{man|5|hosts}}
 +
* ''dns'': the [[#Glibc resolver|glibc resolver]] which reads {{ic|/etc/resolv.conf}}, see {{man|5|resolv.conf}}
  
{{Note|Changes made to {{ic|/etc/resolv.conf}} take effect immediately.}}
+
[[Systemd]] provides three NSS services for hostname resolution:
  
{{Tip|If you require more flexibility, e.g. more than three nameservers, you can use a local DNS resolver like [[dnsmasq]] or [[unbound]]. In this case the nameserver IP address will likely be {{ic|127.0.0.1}}.}}
+
* {{man|8|nss-resolve}} - a caching DNS stub resolver, described in [[systemd-resolved]]
 +
* {{man|8|nss-myhostname}} - provides hostname resolution without having to edit {{ic|/etc/hosts}}, described in [[Network configuration#Local hostname resolution]]
 +
* {{man|8|nss-mymachines}} - provides hostname resolution for the names of local {{man|8|systemd-machined}} containers
  
== DNS in Linux ==
+
=== Resolve a domain name using NSS ===
  
ISPs usually provide working [[wikipedia:Domain_Name_System|DNS]] servers. A router may also add an extra DNS server in case it has its own cache server. Switching between DNS servers is transparent for Windows users, because if a DNS server is slow or does not work it will immediately switch to a better one. However, Linux usually takes longer to timeout, which could be the reason why you are getting a delay.
+
NSS databases can be queried with {{man|1|getent}}. A domain name can be resolved through NSS using:
  
=== Testing ===
+
$ getent hosts ''domain_name''
  
Use ''drill'' (provided by package {{Pkg|ldns}}) before any changes, repeat after making the adjustments and compare the query time(s). The following command uses the nameservers set in {{ic|/etc/resolv.conf}}:
+
{{Note|While most programs resolve domain names using NSS, some may read {{ic|/etc/resolv.conf}} and/or {{ic|/etc/hosts}} directly. See [[Network configuration#Local hostname resolution]].}}
$ drill www.archlinux.org
 
  
You can also specify a specific nameserver's ip address, bypassing the settings in your {{ic|/etc/resolv.conf}}:
+
== Glibc resolver ==
  
$ drill @''ip.of.name.server'' www.archlinux.org
+
The glibc resolver reads {{ic|/etc/resolv.conf}} for every resolution to determine the nameservers and options to use.  
  
For example to test Google's name servers:
+
{{man|5|resolv.conf}} lists nameservers together with some configuration options.
 +
Nameservers listed first are tried first, up to three nameservers may be listed. Lines starting with a number sign ({{ic|#}}) are ignored.
  
$ drill @8.8.8.8 www.archlinux.org
+
{{Note|The glibc resolver does not cache queries. To improve query lookup time you can set up a caching resolver. See [[#Resolvers]] for more information.}}
  
To test a local name server (such as [[unbound]]) do:
+
=== Overwriting of /etc/resolv.conf ===
  
$ drill @127.0.0.1 www.archlinux.org
+
[[Network manager]]s tend to overwrite {{ic|/etc/resolv.conf}}, for specifics see the corresponding section:
  
== Preserve DNS settings ==
+
* [[dhcpcd#resolv.conf]]
 +
* [[netctl#resolv.conf]]
 +
* [[NetworkManager#resolv.conf]]
  
[[dhcpcd]], [[netctl]], [[NetworkManager]], and various other processes can overwrite {{ic|/etc/resolv.conf}}. This is usually desirable behavior, but sometimes DNS settings need to be set manually (e.g. when using a static IP address). There are several ways to accomplish this.
+
To prevent programs from overwriting {{ic|/etc/resolv.conf}} you can also write-protect it by setting the immutable [[file attribute]]:
 
 
*If you are using ''dhcpcd'', see [[#Modify the dhcpcd config]] below.
 
*If you are using [[netctl]] and static IP address assignment, do not use the {{ic|DNS*}} options in your profile, otherwise ''resolvconf'' is called and {{ic|/etc/resolv.conf}} overwritten.
 
 
 
=== Systemd-resolved configuration ===
 
 
 
{{man|8|systemd-resolved}} is a [[systemd]] service that provides network name resolution to local applications.
 
''systemd-resolved'' has [https://jlk.fjfi.cvut.cz/arch/manpages/man/systemd-resolved.8#/ETC/RESOLV.CONF four different modes for handling ''resolv.conf'']. We will focus here on the two most relevant modes.
 
 
 
# The mode in which ''systemd-resolved'' is a client of the {{ic|/etc/resolv.conf}}. This mode preserves {{ic|/etc/resolv.conf}} and is '''compatible''' with the procedures described in this page.
 
# The ''systemd-resolved'''s '''recommended''' mode of operation: the DNS stub file as indicated below contains both the local stub {{ic|127.0.0.53}} as the only DNS servers and a list of search domains.
 
 
 
{{hc|/run/systemd/resolve/stub-resolv.conf|
 
nameserver 127.0.0.53
 
search lan
 
}}
 
 
 
The service users are advised to redirect the {{ic|/etc/resolv.conf}} file to the local stub DNS resolver file {{ic|/run/systemd/resolve/stub-resolv.conf}} managed by ''systemd-resolved''. This propagates the systemd managed configuration to all the clients. This can be done by deleting or renaming the existing {{ic|/etc/resolv.conf}} and replacing it by a symbolic link to the systemd stub:
 
 
 
# ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
 
 
 
In this mode, the DNS servers are provided in the {{man|5|resolved.conf}} file:
 
 
 
{{hc|/etc/systemd/resolved.conf|2=
 
[Resolve]
 
'''DNS=91.239.100.100 89.233.43.71'''
 
...
 
}}
 
 
 
In order to check the DNS actually used by ''systemd-resolved'', the command to use is:
 
 
 
$ systemd-resolve --status
 
 
 
{{Tip|
 
* To understand the context around the DNS choices and switches, one can turn on detailed debug information for ''systemd-resolved'' as described in [[Systemd#Diagnosing a service]].
 
* The mode of operation of ''systemd-resolved'' is detected automatically, depending on whether {{ic|/etc/resolv.conf}} is a symlink to the local stub DNS resolver file or contains server names.
 
}}
 
 
 
=== Prevent NetworkManager modifications ===
 
 
 
{{Move|NetworkManager#Prevent overwriting of resolv.conf|NetworkManager configuration belongs to the [[NetworkManager]] article.|section=Rewrite}}
 
 
 
To stop ''NetworkManager'' from modifying {{ic|/etc/resolv.conf}}, edit {{ic|/etc/NetworkManager/NetworkManager.conf}} and add the following in the {{ic|[main]}} section:
 
 
 
dns=none
 
 
 
{{ic|/etc/resolv.conf}} might be a broken symlink that you will need to remove after doing that. Then, just create a new {{ic|/etc/resolv.conf}} file.
 
 
 
''NetworkManager'' also offers hooks via so called dispatcher scripts that can be used to alter the {{ic|/etc/resolv.conf}} after network changes. See [[NetworkManager#Network services with NetworkManager dispatcher]] and {{man|8|NetworkManager}} for more information.
 
 
 
=== Openresolv ===
 
 
 
{{Pkg|openresolv}} provides a utility ''resolvconf'', which is a framework for managing multiple DNS configurations. See {{man|8|resolvconf}} and {{man|5|resolvconf.conf}} for more information.
 
 
 
The configuration is done in {{ic|/etc/resolvconf.conf}} and running {{ic|resolvconf -u}} will generate {{ic|/etc/resolv.conf}}.
 
 
 
Note that ''NetworkManager'' can be configured to use ''openresolv'', see [[NetworkManager#Configure NetworkManager resolv.conf management mode to use resolvconf]].
 
 
 
=== Modify the dhcpcd config ===
 
 
 
{{Move|dhcpcd#Prevent overwriting of resolv.conf|dhcpcd configuration belongs to the [[dhcpcd]] article.|section=Rewrite}}
 
 
 
''dhcpcd'''s configuration file may be edited to prevent the ''dhcpcd'' daemon from overwriting {{ic|/etc/resolv.conf}}. To do this, add the following to the last section of {{ic|/etc/dhcpcd.conf}}:
 
 
 
nohook resolv.conf
 
 
 
Alternatively, you can create a file called {{ic|/etc/resolv.conf.head}} containing your DNS servers. ''dhcpcd'' will prepend this file to the beginning of {{ic|/etc/resolv.conf}}.
 
 
 
Or you can configure dhcpcd to use the same DNS servers every time. To do this, add the following line at the end of your {{ic|/etc/dhcpcd.conf}}, where {{ic|''dns-server-ip-addressses''}} is a space separated list of DNS IP addresses.
 
 
 
static domain_name_servers=''dns-server-ip-addresses''
 
 
 
For example, to set it to Google's DNS servers:
 
 
 
static domain_name_servers=8.8.8.8 8.8.4.4
 
 
 
=== Write-protect resolv.conf ===
 
 
 
Another way to protect your {{ic|/etc/resolv.conf}} from being modified by anything is setting the immutable (write-protection) attribute:
 
  
 
  # chattr +i /etc/resolv.conf
 
  # chattr +i /etc/resolv.conf
  
== Tips and tricks ==
+
{{Tip|If you want multiple processes to write to {{ic|/etc/resolv.conf}}, you can use [[resolvconf]].}}
  
 
=== Limit lookup time ===
 
=== Limit lookup time ===
Line 140: Line 67:
 
=== Hostname lookup delayed with IPv6 ===
 
=== Hostname lookup delayed with IPv6 ===
  
If you experience a 5 second delay when resolving hostnames it might be due to a DNS-server/Firewall misbehaving and only giving one reply to a parallel A and AAAA request ([http://udrepper.livejournal.com/20948.html source]).
+
If you experience a 5 second delay when resolving hostnames it might be due to a DNS-server/Firewall misbehaving and only giving one reply to a parallel A and AAAA request.[https://udrepper.livejournal.com/20948.html] You can fix that by setting the following option in {{ic|/etc/resolv.conf}}:
You can fix that by setting the following option in {{ic|/etc/resolv.conf}}:
 
  
 
  options single-request
 
  options single-request
Line 147: Line 73:
 
=== Local domain names ===
 
=== Local domain names ===
  
If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to {{ic|resolv.conf}} with the local domain such as:
+
If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to {{ic|/etc/resolv.conf}} with the local domain such as:
  
 
  domain example.com
 
  domain example.com
Line 153: Line 79:
 
That way you can refer to local hosts such as {{ic|mainmachine1.example.com}} as simply {{ic|mainmachine1}} when using the ''ssh'' command, but the ''drill'' command still requires the fully qualified domain names in order to perform lookups.
 
That way you can refer to local hosts such as {{ic|mainmachine1.example.com}} as simply {{ic|mainmachine1}} when using the ''ssh'' command, but the ''drill'' command still requires the fully qualified domain names in order to perform lookups.
  
== Alternative DNS servers ==
+
== Resolvers ==
{{Move|Public DNS servers|While a list of public DNS servers is relevant to DNS configuration it's a different topic.|section=Rewrite}}
 
  
=== Cisco Umbrella (formerly OpenDNS) ===
+
{{Expansion|Fill in the unknowns. Mention {{Pkg|dingo}}, maybe below table because it only works with one provider and therefore doesn't really fit into the table.}}
  
[https://www.opendns.com/home-internet-security/ OpenDNS] provided free alternative nameservers, was [https://umbrella.cisco.com/products/features/opendns-cisco-umbrella bought by Cisco in Nov. 2016] and continues to offer OpenDNS as end-user product of its "Umbrella" product suite with focus on Security Enforcement, Security Intelligence and Web Filtering.
+
The Glibc resolver provides only the most basic necessities, it does not cache queries nor provides any security features. If you require more functionality, use another resolver.
The old nameservers [https://www.opendns.com/setupguide/ still work] but are [https://www.opendns.com/home-internet-security/ pre-configured to block adult content]:
 
  
IPv4 nameservers
+
{{Tip|
208.67.222.222
+
* The ''drill'' or ''dig'' [[#Lookup utilities|lookup utilities]] report the query time.
208.67.220.220
+
* A router usually sets its own caching resolver as the network's DNS server thus providing DNS cache for the whole network.
 
+
* If it takes too long to switch to the next DNS server you can try [[#Limit lookup time|decreasing the timeout]].
IPv6 nameservers
+
}}
2620:0:ccc::2
 
2620:0:ccd::2
 
 
 
=== Cloudflare ===
 
 
 
[https://1.1.1.1/ Cloudflare] provides a service committed to never writing the querying IP addresses to disk and wiping all logs within 24 hours, with the exception of providing data to APNIC labs for research purposes. APNIC and Cloudfare committed to treat all data with high privacy standards in their [https://labs.apnic.net/?p=1127 research agreement statement].
 
 
 
IPv4 nameservers:
 
1.1.1.1
 
1.0.0.1
 
 
 
IPv6 nameservers:
 
2606:4700:4700::1111
 
2606:4700:4700::1001
 
 
 
=== Comodo ===
 
 
 
[http://securedns.dnsbycomodo.com/ Comodo] provides another IPv4 set, with optional (non-free) web-filtering. Implied in this feature is that the service hijacks the queries.
 
 
 
8.26.56.26
 
8.20.247.20
 
 
 
=== DNS.WATCH ===
 
 
 
[https://dns.watch/ DNS.WATCH] focuses on neutrality and security and provides two servers located in Germany with no logging and with DNSSEC enabled. Note they welcome commercial sponsorship.
 
 
 
84.200.69.80    # resolver1.dns.watch
 
84.200.70.40    # resolver2.dns.watch
 
 
 
=== Google ===
 
 
 
[https://developers.google.com/speed/public-dns/ Google's nameservers] can be used as an alternative:
 
 
 
IPv4 nameservers
 
8.8.8.8
 
8.8.4.4
 
  
IPv6 nameservers
+
In the table below, the columns have the following meaning:  
2001:4860:4860::8888
 
2001:4860:4860::8844
 
 
 
=== OpenNIC ===
 
 
 
[http://www.opennicproject.org/ OpenNIC] provides free uncensored nameservers located in multiple countries. The full list of public servers is available at [https://servers.opennic.org/ servers.opennic.org] and a shortlist of nearest nameservers for optimal performance is generated on their [https://www.opennic.org/ home page].
 
 
 
To retrieve a list of nearest nameservers, an [https://wiki.opennic.org/api/geoip API] is also available and returns, based on the [https://wiki.opennic.org/api/geoip#url_parameters URL parameters] provided, a list of nameservers in the desired format. For example to get the 200 nearest IPv4 servers, one can use https://api.opennicproject.org/geoip/?list&ipv=4&res=200&adm=0&bl&wl.
 
 
 
Alternatively, the anycast servers below can be used; while reliable their latency [https://wiki.opennic.org/opennic/dont_anycast fluctuates a lot].
 
 
 
IPv4 nameservers (Worldwide Anycast)
 
185.121.177.177
 
185.121.177.53
 
 
 
IPv6 nameservers (Worldwide Anycast)
 
2a05:dfc7:5::53
 
2a05:dfc7:5::5353
 
 
 
{{Note|
 
* The use of OpenNIC DNS servers will allow host name resolution in the traditional Top-Level Domain (TLD) registries, but also in OpenNIC or afiliated operated namespaces: ''.o'', ''.libre'', ''.dyn''...
 
* The tool {{App|opennic-up|automates the renewal of the DNS servers with the most responsive OpenNIC servers|https://github.com/kewlfft/opennic-up|{{AUR|opennic-up}}}}
 
}}
 
  
=== Quad9 ===
+
* ''Cache'': [[Wikipedia:Name server#Caching name server|caches]] the DNS queries to improve lookup times of subsequent identical requests.
 +
* ''Recursor'': can [[Wikipedia:Name server#Recursive query|recursively query]] the domain name starting from the [[Wikipedia:DNS root zone|DNS root zone]].
 +
* ''resolvconf compatibility'': can acquire name servers and search domains, to use for forwarding requests, from software that sets them using [[resolvconf]].
 +
* ''Validates DNSSEC'': [[Wikipedia:Domain Name System Security Extensions#The lookup procedure|validates]] DNS query responses using [[DNSSEC]].
 +
* ''DNS over TLS'': supports forwarding using the [[Wikipedia:DNS over TLS|DNS over TLS]] protocol.
 +
* ''DNS over HTTPS'': supports forwarding using the [[Wikipedia:DNS over HTTPS|DNS over HTTPS]] protocol.
  
[https://quad9.net/#/ Quad9] is a free DNS service founded by [https://www.ibm.com/security IBM], [https://www.pch.net Packet Clearing House] and [https://www.globalcyberalliance.org Global Cyber Alliance]; its primary unique feature is a blocklist which avoids resolving known malicious domains. The addresses below are worldwide anycast.
+
{| class="wikitable sortable" style="text-align:center"
 +
! Resolver !! Cache !! Recursor !! ''resolvconf'' compatibility !!  Validates DNSSEC !! DNS over TLS !! DNS over HTTPS
 +
|-
 +
! [[#Glibc resolver|glibc]]
 +
| {{No}} || {{No}} || {{G|[[openresolv]]}} || {{No}} || {{No}} || {{No}}
 +
|-
 +
! [[BIND]]
 +
| {{Yes}} || {{Yes}} || {{G|[[openresolv]] subscriber}} || {{Yes}} || ? || ?
 +
|-
 +
! [[dnscrypt-proxy]]<sup>1</sup>
 +
| {{Yes}} || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}}
 +
|-
 +
! [[dnsmasq]]
 +
| {{Yes}} || {{No}} || {{G|[[openresolv]] subscriber}} || {{Yes}} || {{No|http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2018q2/012131.html}} || {{No}}
 +
|-
 +
! [[Knot Resolver]]
 +
| {{Yes}} || {{Yes}} || {{No}} || {{Yes}} || {{Yes}} || {{No|https://gitlab.labs.nic.cz/knot/knot-resolver/issues/243}}
 +
|-
 +
! [[pdnsd]]
 +
| {{Yes}} || {{Yes}} || {{G|[[openresolv]] subscriber}} || {{No}} || {{No}} || {{No}}
 +
|-
 +
! {{Pkg|powerdns-recursor}}
 +
| {{Yes}} || {{Yes}} || {{No|https://roy.marples.name/projects/openresolv/config#pdns_recursor}} || {{Yes}} || ? || ?
 +
|-
 +
! [[Rescached]]
 +
| {{Yes}} || {{No}} || {{G|[[openresolv]] subscriber}}<sup>2</sup> || {{No}} || {{No}} || {{Y|Limited}}<sup>3</sup>
 +
|-
 +
! [[Stubby]]
 +
| {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{No}}
 +
|-
 +
!style="white-space: nowrap;"| [[systemd-resolved]]
 +
| {{Yes}} || {{No}} || {{G|[[systemd-resolvconf]]}} || {{Yes}} || {{Y|Insecure}}<sup>4</sup> || {{No|https://github.com/systemd/systemd/issues/8639}}
 +
|-
 +
! [[Unbound]]
 +
| {{Yes}} || {{Yes}} || {{G|[[openresolv]] subscriber}} || {{Yes}} || {{Yes}} || {{No|1=https://nlnetlabs.nl/bugs-script/show_bug.cgi?id=1200}}
 +
|}
  
IPv4 nameservers
+
# Implements a [[Wikipedia:DNSCrypt|DNSCrypt]] protocol client.
9.9.9.9    ## "secure", with blocklist and DNSSEC
+
# Can use the subscribers of dnsmasq, pdns and unbound.[https://github.com/shuLhan/rescached-go#integration-with-openresolv]
9.9.9.10    ## no blocklist, no DNSSEC
+
# Only forwards using DNS over HTTPS when Rescached itself is queried using DNS over HTTPS.[https://github.com/shuLhan/rescached-go#integration-with-dns-over-https]
 +
# From {{man|5|resolved.conf}}: ''Note as the resolver is not capable of authenticating the server, it is vulnerable for "man-in-the-middle" attacks.''[https://github.com/systemd/systemd/issues/9397] Also, the only supported mode is "opportunistic", which ''makes DNS-over-TLS vulnerable to "downgrade" attacks''.[https://github.com/systemd/systemd/issues/10755]
  
IPv6 nameservers
+
== Privacy ==
2620:fe::fe    ## "secure", with blocklist and DNSSEC
 
2620:fe::10    ## no blocklist, no DNSSEC
 
  
=== UncensoredDNS ===
+
DNS is not encrypted, so you may want to use a [[#Resolvers|resolver]] that supports an encrypted protocol, like [[Wikipedia:DNS over TLS|DNS over TLS]], [[Wikipedia:DNS over HTTPS|DNS over HTTPS]] or [[Wikipedia:DNSCrypt|DNSCrypt]].
  
[http://censurfridns.dk UncensoredDNS] is a free uncensored DNS service. It is run by a private individual and consists in one anycast served by multiple servers and one unicast node hosted in Denmark.
+
Most DNS servers keep a log of IP addresses and sites visited on a more or less temporary basis. The data collected can be used to perform various statistical studies. Personally-identifying information have value and can also be rented or sold to third parties. [[Alternative DNS services]] provides a list of popular services, check their privacy policy for information about how user data is handled.
  
IPv4 nameservers
+
== Lookup utilities ==
91.239.100.100    ## anycast.censurfridns.dk
 
89.233.43.71      ## unicast.censurfridns.dk
 
  
IPv6 nameservers
+
To query specific DNS servers and DNS/[[DNSSEC]] records you can use dedicated DNS lookup utilities. These tools implement DNS themselves and do not use [[#Name Service Switch|NSS]].
2001:67c:28a4::  ## anycast.censurfridns.dk
 
2a01:3a0:53:53::  ## unicast.censurfridns.dk
 
  
{{Note|Its servers listen to port 5353 as well as the standard port 53. This can be used in case your ISP hijacks port 53.}}
+
* {{Pkg|ldns}} provides {{man|1|drill}}, which is a tool designed to retrieve information out of the DNS.
  
=== Yandex ===
+
For example, to query a specific nameserver with ''drill'' for the TXT records of a domain:
  
[https://dns.yandex.com/advanced/ Yandex.DNS] has servers in Russia, Eastern and Western Europe and has three options, ''Basic'', ''Safe'' and ''Family'':
+
$ drill @''nameserver'' TXT ''domain''
  
Basic Yandex.DNS - Quick and reliable DNS
+
If you do not specify a DNS server ''drill'' uses the nameservers defined in {{ic|/etc/resolv.conf}}.
77.88.8.8              # Preferred IPv4 DNS
 
77.88.8.1              # Alternate IPv4 DNS
 
 
2a02:6b8::feed:0ff    # Preferred IPv6 DNS
 
2a02:6b8:0:1::feed:0ff # Alternate IPv6 DNS
 
  
Safe Yandex.DNS - Protection from virus and fraudulent content
+
* {{Pkg|bind-tools}} provides {{man|1|dig}}, {{man|1|host}}, {{man|1|nslookup}} and a bunch of {{ic|dnssec-}} tools.
77.88.8.88            # Preferred IPv4 DNS
 
77.88.8.2              # Alternate IPv4 DNS
 
 
2a02:6b8::feed:bad    # Preferred IPv6 DNS
 
2a02:6b8:0:1::feed:bad # Alternate IPv6 DNS
 
  
Family Yandex.DNS - Without adult content
+
== See also ==
77.88.8.7              # Preferred IPv4 DNS
 
77.88.8.3              # Alternate IPv4 DNS
 
 
2a02:6b8::feed:a11    # Preferred IPv6 DNS
 
2a02:6b8:0:1::feed:a11 # Alternate IPv6 DNS
 
  
Yandex.DNS' speed is the same in the three modes. In ''Basic'' mode, there is no traffic filtering. In ''Safe'' mode, protection from infected and fraudulent sites is provided. ''Family'' mode enables protection from dangerous sites and blocks sites with adult content.
+
* [https://www.tldp.org/LDP/nag2/x-087-2-resolv.html Linux Network Administrators Guide]
 +
* [https://www.debian.org/doc/manuals/debian-handbook/sect.hostname-name-service.en.html#sect.name-resolution Debian Handbook]

Latest revision as of 13:49, 17 November 2018

In general, a domain name represents an IP address and is associated to it in the Domain Name System (DNS). This article explains how to configure domain name resolution and resolve domain names.

Name Service Switch

The Name Service Switch (NSS) facility is part of the GNU C Library (glibc) and backs the getaddrinfo(3) API, used to resolve domain names. NSS allows system databases to be provided by separate services, whose search order can be configured by the administrator in nsswitch.conf(5). The database responsible for domain name resolution is the hosts database, for which glibc offers the following services:

Systemd provides three NSS services for hostname resolution:

Resolve a domain name using NSS

NSS databases can be queried with getent(1). A domain name can be resolved through NSS using:

$ getent hosts domain_name
Note: While most programs resolve domain names using NSS, some may read /etc/resolv.conf and/or /etc/hosts directly. See Network configuration#Local hostname resolution.

Glibc resolver

The glibc resolver reads /etc/resolv.conf for every resolution to determine the nameservers and options to use.

resolv.conf(5) lists nameservers together with some configuration options. Nameservers listed first are tried first, up to three nameservers may be listed. Lines starting with a number sign (#) are ignored.

Note: The glibc resolver does not cache queries. To improve query lookup time you can set up a caching resolver. See #Resolvers for more information.

Overwriting of /etc/resolv.conf

Network managers tend to overwrite /etc/resolv.conf, for specifics see the corresponding section:

To prevent programs from overwriting /etc/resolv.conf you can also write-protect it by setting the immutable file attribute:

# chattr +i /etc/resolv.conf
Tip: If you want multiple processes to write to /etc/resolv.conf, you can use resolvconf.

Limit lookup time

If you are confronted with a very long hostname lookup (may it be in pacman or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in /etc/resolv.conf.

options timeout:1

Hostname lookup delayed with IPv6

If you experience a 5 second delay when resolving hostnames it might be due to a DNS-server/Firewall misbehaving and only giving one reply to a parallel A and AAAA request.[1] You can fix that by setting the following option in /etc/resolv.conf:

options single-request

Local domain names

If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to /etc/resolv.conf with the local domain such as:

domain example.com

That way you can refer to local hosts such as mainmachine1.example.com as simply mainmachine1 when using the ssh command, but the drill command still requires the fully qualified domain names in order to perform lookups.

Resolvers

Tango-view-fullscreen.pngThis article or section needs expansion.Tango-view-fullscreen.png

Reason: Fill in the unknowns. Mention dingo, maybe below table because it only works with one provider and therefore doesn't really fit into the table. (Discuss in Talk:Domain name resolution#)

The Glibc resolver provides only the most basic necessities, it does not cache queries nor provides any security features. If you require more functionality, use another resolver.

Tip:
  • The drill or dig lookup utilities report the query time.
  • A router usually sets its own caching resolver as the network's DNS server thus providing DNS cache for the whole network.
  • If it takes too long to switch to the next DNS server you can try decreasing the timeout.

In the table below, the columns have the following meaning:

  • Cache: caches the DNS queries to improve lookup times of subsequent identical requests.
  • Recursor: can recursively query the domain name starting from the DNS root zone.
  • resolvconf compatibility: can acquire name servers and search domains, to use for forwarding requests, from software that sets them using resolvconf.
  • Validates DNSSEC: validates DNS query responses using DNSSEC.
  • DNS over TLS: supports forwarding using the DNS over TLS protocol.
  • DNS over HTTPS: supports forwarding using the DNS over HTTPS protocol.
Resolver Cache Recursor resolvconf compatibility Validates DNSSEC DNS over TLS DNS over HTTPS
glibc No No openresolv No No No
BIND Yes Yes openresolv subscriber Yes ? ?
dnscrypt-proxy1 Yes No No No No Yes
dnsmasq Yes No openresolv subscriber Yes No No
Knot Resolver Yes Yes No Yes Yes No
pdnsd Yes Yes openresolv subscriber No No No
powerdns-recursor Yes Yes No Yes ? ?
Rescached Yes No openresolv subscriber2 No No Limited3
Stubby No No No Yes Yes No
systemd-resolved Yes No systemd-resolvconf Yes Insecure4 No
Unbound Yes Yes openresolv subscriber Yes Yes No
  1. Implements a DNSCrypt protocol client.
  2. Can use the subscribers of dnsmasq, pdns and unbound.[2]
  3. Only forwards using DNS over HTTPS when Rescached itself is queried using DNS over HTTPS.[3]
  4. From resolved.conf(5): Note as the resolver is not capable of authenticating the server, it is vulnerable for "man-in-the-middle" attacks.[4] Also, the only supported mode is "opportunistic", which makes DNS-over-TLS vulnerable to "downgrade" attacks.[5]

Privacy

DNS is not encrypted, so you may want to use a resolver that supports an encrypted protocol, like DNS over TLS, DNS over HTTPS or DNSCrypt.

Most DNS servers keep a log of IP addresses and sites visited on a more or less temporary basis. The data collected can be used to perform various statistical studies. Personally-identifying information have value and can also be rented or sold to third parties. Alternative DNS services provides a list of popular services, check their privacy policy for information about how user data is handled.

Lookup utilities

To query specific DNS servers and DNS/DNSSEC records you can use dedicated DNS lookup utilities. These tools implement DNS themselves and do not use NSS.

  • ldns provides drill(1), which is a tool designed to retrieve information out of the DNS.

For example, to query a specific nameserver with drill for the TXT records of a domain:

$ drill @nameserver TXT domain

If you do not specify a DNS server drill uses the nameservers defined in /etc/resolv.conf.

See also