Difference between revisions of "Resolv.conf"

From ArchWiki
Jump to: navigation, search
m (i18n)
(Systemd-resolved configuration: clarifies which 'file' this is about)
 
(151 intermediate revisions by 42 users not shown)
Line 1: Line 1:
[[Category:Networking]]
+
{{Lowercase title}}
 +
[[Category:Domain Name System]]
 +
[[de:Resolv.conf]]
 
[[es:Resolv.conf]]
 
[[es:Resolv.conf]]
[[de:Resolv.conf]]
+
[[fr:Resolv.conf]]
 
[[it:Resolv.conf]]
 
[[it:Resolv.conf]]
[[zh-CN:Resolv.conf]]
+
[[ja:Resolv.conf]]
From from the [http://www.kernel.org/doc/man-pages/online/pages/man5/resolv.conf.5.html resolv.conf(5)] man page:
+
[[zh-hans:Resolv.conf]]
:''"The resolver is a set of routines in the C library that provide access to the Internet Domain Name System (DNS). The resolver configuration file contains information that is read by the resolver routines the first time they are invoked by a process. The file is designed to be human readable and contains a list of keywords with values that provide various types of resolver information.''
+
{{Related articles start}}
 +
{{Related|Improving performance#Network}}
 +
{{Related articles end}}
 +
 
 +
The configuration file for DNS resolvers is {{ic|/etc/resolv.conf}}. From {{man|5|resolv.conf}}:
 +
:The resolver is a set of routines in the C library that provide access to the Internet Domain Name System (DNS). The resolver configuration file contains information that is read by the resolver routines the first time they are invoked by a process. The file is designed to be human readable and contains a list of keywords with values that provide various types of resolver information.
 +
 
 +
:If this file does not exist, only the name server on the local machine will be queried; the domain name is determined from the hostname and the domain search path is constructed from the domain name.
 +
 
 +
== DNS in Linux ==
 +
 
 +
ISPs usually provide working [[wikipedia:Domain_Name_System|DNS]] servers. A router may also add an extra DNS server in case it has its own cache server. Switching between DNS servers is transparent for Windows users, because if a DNS server is slow or does not work it will immediately switch to a better one. However, Linux usually takes longer to timeout, which could be the reason why you are getting a delay.
 +
 
 +
=== Testing ===
 +
 
 +
Use ''drill'' (provided by package {{Pkg|ldns}}) before any changes, repeat after making the adjustments and compare the query time(s). The following command uses the nameservers set in {{ic|/etc/resolv.conf}}:
 +
$ drill www.archlinux.org
 +
 
 +
You can also specify a specific nameserver's ip address, bypassing the settings in your {{ic|/etc/resolv.conf}}:
 +
 
 +
$ drill @''ip.of.name.server'' www.archlinux.org
 +
 
 +
For example to test Google's name servers:
  
:''"On a  normally  configured  system this file should not be necessary. The only name server to be queried will be on the local machine; the domain name is determined from the host name and the domain search path is constructed from the domain name."''
+
  $ drill @8.8.8.8 www.archlinux.org
  
==Preserve DNS settings==
+
To test a local name server (such as [[unbound]]) do:
{{Pkg|dhcpcd}}, [[NetworkManager]], and various other processes can overwrite {{ic|/etc/resolv.conf}}. This is usually desirable behavior, but sometimes DNS settings need to be set manually (e.g. when using a static IP address). There are several ways to accomplish this. If you are using NetworkManager, see [http://bbs.archlinux.org/viewtopic.php?id=45394 this thread] on how to prevent it from overriding your {{ic|/etc/resolv.conf}}.
 
  
===Modify the dhcpcd Config===
+
$ drill @127.0.0.1 www.archlinux.org
dhcpcd's configuration file may be edited to prevent the dhcpcd daemon from overwriting {{ic|/etc/resolv.conf}}. To do this, add the following to the last section of {{ic|/etc/dhcpcd.conf}}:
 
  
nohook resolv.conf
+
== Alternative DNS servers ==
 +
 
 +
To use alternative DNS servers, edit {{ic|/etc/resolv.conf}} and add them at the top of the list so they are used first, optionally removing or commenting out other servers. Currently, you may include a maximum of three nameservers.
 +
 
 +
{{Note|Changes made to {{ic|/etc/resolv.conf}} take effect immediately.}}
 +
 
 +
{{Tip|If you require more flexibility, e.g. more than three nameservers, you can use a local DNS resolver like [[dnsmasq]] or [[unbound]]. In this case the nameserver IP address will likely be {{ic|127.0.0.1}}.}}
  
===Use resolv.conf.head===
+
=== Cisco Umbrella (formerly OpenDNS) ===
Alternatively, you can create a file called {{ic|/etc/resolv.conf.head}} containing your DNS servers. dhcpcd will prepend this file to the beginning of {{ic|/etc/resolv.conf}}. An example {{ic|/etc/resolv.conf.head}} for someone using [[OpenDNS]] would be:
+
[https://www.opendns.com/home-internet-security/ OpenDNS] provided free alternative nameservers, was [https://umbrella.cisco.com/products/features/opendns-cisco-umbrella bought by Cisco in Nov. 2016] and continues to offer OpenDNS as end-user product of its "Umbrella" product suite with focus on Security Enforcement, Security Intelligence and Web Filtering.
 +
The old nameservers [https://www.opendns.com/setupguide/ still work] but are [https://www.opendns.com/home-internet-security/ pre-configured to block adult content]:
  
  # OpenDNS servers
+
  # OpenDNS IPv4 nameservers
 
  nameserver 208.67.222.222
 
  nameserver 208.67.222.222
 
  nameserver 208.67.220.220
 
  nameserver 208.67.220.220
  
If you are not pleased with the OpenDNS servers, you might try [https://developers.google.com/speed/public-dns/ Google's nameservers] as an alternative.
+
# OpenDNS IPv6 nameservers
  # Google nameservers
+
nameserver 2620:0:ccc::2
 +
nameserver 2620:0:ccd::2
 +
 
 +
=== Cloudflare ===
 +
[https://1.1.1.1/ Cloudflare] provides a service committed to never writing the querying IP addresses to disk and wiping all logs within 24 hours, with the exception of providing data to APNIC labs for research purposes. APNIC and Cloudfare committed to treat all data with high privacy standards in their [https://labs.apnic.net/?p=1127 research agreement statement].
 +
 
 +
# IPv4 nameservers:
 +
nameserver 1.1.1.1
 +
nameserver 1.0.0.1
 +
 
 +
# IPv6 nameservers:
 +
nameserver 2606:4700:4700::1111
 +
nameserver 2606:4700:4700::1001
 +
 
 +
=== Comodo ===
 +
[http://securedns.dnsbycomodo.com/ Comodo] provides another IPv4 set, with optional (non-free) web-filtering. Implied in this feature is that the service hijacks the queries.
 +
 
 +
# Comodo nameservers
 +
nameserver 8.26.56.26
 +
nameserver 8.20.247.20
 +
 
 +
=== DNS.WATCH ===
 +
[https://dns.watch/ DNS.WATCH] focuses on neutrality and security and provides two servers located in Germany with no logging and with DNSSEC enabled. Note they welcome commercial sponsorship.
 +
 
 +
# dns.watch IPv4 nameservers
 +
nameserver 84.200.69.80    # resolver1.dns.watch
 +
nameserver 84.200.70.40    # resolver2.dns.watch
 +
 
 +
=== Google ===
 +
[https://developers.google.com/speed/public-dns/ Google's nameservers] can be used as an alternative:
 +
 
 +
  # Google IPv4 nameservers
 
  nameserver 8.8.8.8
 
  nameserver 8.8.8.8
 
  nameserver 8.8.4.4
 
  nameserver 8.8.4.4
  
===Write-protect /etc/resolv.conf===
+
# Google IPv6 nameservers
Another way to protect your {{ic|/etc/resolv.conf}} from being modified by anything is setting the write-protection attribute:
+
nameserver 2001:4860:4860::8888
  chattr +i /etc/resolv.conf
+
nameserver 2001:4860:4860::8844
 +
 
 +
=== OpenNIC ===
 +
[http://www.opennicproject.org/ OpenNIC] provides free uncensored nameservers located in multiple countries. The full list of public servers is available at [https://servers.opennic.org/ servers.opennic.org] and a shortlist of nearest nameservers for optimal performance is generated on their [https://www.opennic.org/ home page].
 +
 
 +
To retrieve a list of nearest nameservers, an [https://wiki.opennic.org/api/geoip API] is also available and returns, based on the [https://wiki.opennic.org/api/geoip#url_parameters URL parameters] provided, a list of nameservers in the desired format. For example to get the 200 nearest IPv4 servers, one can use https://api.opennicproject.org/geoip/?list&ipv=4&res=200&adm=0&bl&wl.
 +
 
 +
Alternatively, the anycast servers below can be used; while reliable their latency [https://wiki.opennic.org/opennic/dont_anycast fluctuates a lot].
 +
 
 +
# OpenNIC IPv4 nameservers (Worldwide Anycast)
 +
nameserver 185.121.177.177
 +
nameserver 185.121.177.53
 +
 
 +
# OpenNIC IPv6 nameservers (Worldwide Anycast)
 +
nameserver 2a05:dfc7:5::53
 +
nameserver 2a05:dfc7:5::5353
 +
 
 +
{{Note|
 +
* The use of OpenNIC DNS servers will allow host name resolution in the traditional Top-Level Domain (TLD) registries, but also in OpenNIC or afiliated operated namespaces: ''.o'', ''.libre'', ''.dyn''...
 +
* The tool {{App|opennic-up|automates the renewal of the DNS servers with the most responsive OpenNIC servers|https://github.com/kewlfft/opennic-up|{{AUR|opennic-up}}}}}}
 +
 
 +
=== Quad9 ===
 +
[https://quad9.net/#/ Quad9] is a free DNS service founded by [https://www.ibm.com/security IBM], [https://www.pch.net Packet Clearing House] and [https://www.globalcyberalliance.org Global Cyber Alliance]; its primary unique feature is a blocklist which avoids resolving known malicious domains. The addresses below are worldwide anycast.
 +
 
 +
# Quad9 IPv4 nameservers
 +
nameserver 9.9.9.9    ## "secure", with blocklist and DNSSEC
 +
nameserver 9.9.9.10    ## no blocklist, no DNSSEC
 +
 
 +
# Quad9 IPv6 nameservers
 +
nameserver 2620:fe::fe    ## "secure", with blocklist and DNSSEC
 +
nameserver 2620:fe::10    ## no blocklist, no DNSSEC
 +
 
 +
=== UncensoredDNS ===
 +
[http://censurfridns.dk UncensoredDNS] is a free uncensored DNS service. It is run by a private individual and consists in one anycast served by multiple servers and one unicast node hosted in Denmark.
 +
 
 +
# censurfridns.dk IPv4 nameservers
 +
nameserver 91.239.100.100    ## anycast.censurfridns.dk
 +
nameserver 89.233.43.71      ## unicast.censurfridns.dk
 +
 
 +
# censurfridns.dk IPv6 nameservers
 +
nameserver 2001:67c:28a4::  ## anycast.censurfridns.dk
 +
nameserver 2a01:3a0:53:53::  ## unicast.censurfridns.dk
 +
 
 +
{{Note|Its servers listen to port 5353 as well as the standard port 53. This can be used in case your ISP hijacks port 53.}}
 +
 
 +
=== Yandex ===
 +
[https://dns.yandex.com/advanced/ Yandex.DNS] has servers in Russia, Eastern and Western Europe and has three options, ''Basic'', ''Safe'' and ''Family'':
 +
 
 +
# Basic Yandex.DNS - Quick and reliable DNS
 +
nameserver 77.88.8.8              # Preferred IPv4 DNS
 +
nameserver 77.88.8.1              # Alternate IPv4 DNS
 +
 +
nameserver 2a02:6b8::feed:0ff    # Preferred IPv6 DNS
 +
nameserver 2a02:6b8:0:1::feed:0ff # Alternate IPv6 DNS
 +
 
 +
# Safe Yandex.DNS - Protection from virus and fraudulent content
 +
nameserver 77.88.8.88            # Preferred IPv4 DNS
 +
nameserver 77.88.8.2              # Alternate IPv4 DNS
 +
 +
nameserver 2a02:6b8::feed:bad    # Preferred IPv6 DNS
 +
nameserver 2a02:6b8:0:1::feed:bad # Alternate IPv6 DNS
 +
 
 +
# Family Yandex.DNS - Without adult content
 +
nameserver 77.88.8.7              # Preferred IPv4 DNS
 +
nameserver 77.88.8.3              # Alternate IPv4 DNS
 +
 +
nameserver 2a02:6b8::feed:a11    # Preferred IPv6 DNS
 +
nameserver 2a02:6b8:0:1::feed:a11 # Alternate IPv6 DNS
 +
 
 +
Yandex.DNS' speed is the same in the three modes. In ''Basic'' mode, there is no traffic filtering. In ''Safe'' mode, protection from infected and fraudulent sites is provided. ''Family'' mode enables protection from dangerous sites and blocks sites with adult content.
 +
 
 +
== Preserve DNS settings ==
 +
 
 +
[[dhcpcd]], [[netctl]], [[NetworkManager]], and various other processes can overwrite {{ic|/etc/resolv.conf}}. This is usually desirable behavior, but sometimes DNS settings need to be set manually (e.g. when using a static IP address). There are several ways to accomplish this.
 +
*If you are using ''dhcpcd'', see [[#Modify the dhcpcd config]] below.
 +
*If you are using [[netctl]] and static IP address assignment, do not use the {{ic|DNS*}} options in your profile, otherwise ''resolvconf'' is called and {{ic|/etc/resolv.conf}} overwritten.
 +
 
 +
=== Systemd-resolved configuration ===
 +
{{man|8|systemd-resolved}} is a [[systemd]] service that provides network name resolution to local applications.
 +
''systemd-resolved'' has [https://jlk.fjfi.cvut.cz/arch/manpages/man/systemd-resolved.8#/ETC/RESOLV.CONF four different modes for handling ''resolv.conf'']. In one of the modes, it is a consumer of the {{ic|/etc/resolv.conf}} file and any change made to it is going to be preserved and taken into account transparently for the user. This mode is therefore compatible with the procedures described in this page.
 +
 
 +
However, this is not ''systemd-resolved'''s recommended mode of operation. The service users are advised to redirect software which read the {{ic|/etc/resolv.conf}} file to the local stub DNS resolver managed by ''systemd-resolved''. This can be done by deleting or renaming the existing {{ic|/etc/resolv.conf}} and replacing it by a symbolic link to the systemd stub: {{bc|ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf}}
 +
In this mode, the DNS servers are provided in the {{man|5|resolved.conf}} file.
 +
In order to check the DNS actually used by ''systemd-resolved'', the command to use is:
 +
 
 +
$ systemd-resolve --status
 +
 
 +
{{Tip|To understand the context around the DNS choices and switches, one can turn on detailed debug information for ''systemd-resolved'' as described in [[Systemd#Diagnosing a service]].}}
 +
 
 +
=== Prevent NetworkManager modifications ===
 +
 
 +
To stop ''NetworkManager'' from modifying {{ic|/etc/resolv.conf}}, edit {{ic|/etc/NetworkManager/NetworkManager.conf}} and add the following in the {{ic|[main]}} section:
 +
 
 +
dns=none
 +
 
 +
{{ic|/etc/resolv.conf}} might be a broken symlink that you will need to remove after doing that. Then, just create a new {{ic|/etc/resolv.conf}} file.
 +
 
 +
''NetworkManager'' also offers hooks via so called dispatcher scripts that can be used to alter the {{ic|/etc/resolv.conf}} after network changes. See [[NetworkManager#Network services with NetworkManager dispatcher]] and {{man|8|NetworkManager}} for more information.
 +
 
 +
=== Use openresolv ===
 +
 
 +
{{Pkg|openresolv}} provides a utility ''resolvconf'', which is a framework for managing multiple DNS configurations. See {{man|8|resolvconf}} and {{man|5|resolvconf.conf}} for more information.
 +
 
 +
The configuration is done in {{ic|/etc/resolvconf.conf}} and running {{ic|resolvconf -u}} will generate {{ic|/etc/resolv.conf}}.
 +
 
 +
Note that ''NetworkManager'' can be configured to use ''openresolv'', see [[NetworkManager#Configure NetworkManager resolv.conf management mode to use resolvconf]].
 +
 
 +
=== Modify the dhcpcd config ===
 +
 
 +
''dhcpcd'''s configuration file may be edited to prevent the ''dhcpcd'' daemon from overwriting {{ic|/etc/resolv.conf}}. To do this, add the following to the last section of {{ic|/etc/dhcpcd.conf}}:
 +
 
 +
nohook resolv.conf
 +
 
 +
Alternatively, you can create a file called {{ic|/etc/resolv.conf.head}} containing your DNS servers. ''dhcpcd'' will prepend this file to the beginning of {{ic|/etc/resolv.conf}}.
 +
 
 +
Or you can configure dhcpcd to use the same DNS servers every time. To do this, add the following line at the end of your {{ic|/etc/dhcpcd.conf}}, where {{ic|''dns-server-ip-addressses''}} is a space separated list of DNS IP addresses.
 +
 
 +
static domain_name_servers=''dns-server-ip-addresses''
 +
 
 +
For example, to set it to Google's DNS servers:
 +
 
 +
static domain_name_servers=8.8.8.8 8.8.4.4
 +
 
 +
=== Write-protect resolv.conf ===
 +
 
 +
Another way to protect your {{ic|/etc/resolv.conf}} from being modified by anything is setting the immutable (write-protection) attribute:
 +
 
 +
  # chattr +i /etc/resolv.conf
 +
 
 +
== Tips and tricks ==
 +
 
 +
=== Limit lookup time ===
 +
 
 +
If you are confronted with a very long hostname lookup (may it be in [[pacman]] or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in {{ic|/etc/resolv.conf}}.
  
===Use timeout option to reduce hostname lookup time===
 
If you are confronted with a very long hostname lookup (may it be in [[pacman]] or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, create a file called {{ic|/etc/resolv.conf.tail}} and add the following line:
 
 
  options timeout:1
 
  options timeout:1
  
Then restart your network daemon and see if it works better.
+
=== Hostname lookup delayed with IPv6 ===
 +
 
 +
If you experience a 5 second delay when resolving hostnames it might be due to a DNS-server/Firewall misbehaving and only giving one reply to a parallel A and AAAA request ([http://udrepper.livejournal.com/20948.html source]).
 +
You can fix that by setting the following option in {{ic|/etc/resolv.conf}}:
 +
 
 +
options single-request
 +
 
 +
=== Local domain names ===
 +
 
 +
If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to {{ic|resolv.conf}} with the local domain such as:
 +
 
 +
domain example.com
 +
 
 +
That way you can refer to local hosts such as {{ic|mainmachine1.example.com}} as simply {{ic|mainmachine1}} when using the ''ssh'' command, but the ''drill'' command still requires the fully qualified domain names in order to perform lookups.

Latest revision as of 13:04, 20 April 2018

The configuration file for DNS resolvers is /etc/resolv.conf. From resolv.conf(5):

The resolver is a set of routines in the C library that provide access to the Internet Domain Name System (DNS). The resolver configuration file contains information that is read by the resolver routines the first time they are invoked by a process. The file is designed to be human readable and contains a list of keywords with values that provide various types of resolver information.
If this file does not exist, only the name server on the local machine will be queried; the domain name is determined from the hostname and the domain search path is constructed from the domain name.

DNS in Linux

ISPs usually provide working DNS servers. A router may also add an extra DNS server in case it has its own cache server. Switching between DNS servers is transparent for Windows users, because if a DNS server is slow or does not work it will immediately switch to a better one. However, Linux usually takes longer to timeout, which could be the reason why you are getting a delay.

Testing

Use drill (provided by package ldns) before any changes, repeat after making the adjustments and compare the query time(s). The following command uses the nameservers set in /etc/resolv.conf:

$ drill www.archlinux.org

You can also specify a specific nameserver's ip address, bypassing the settings in your /etc/resolv.conf:

$ drill @ip.of.name.server www.archlinux.org

For example to test Google's name servers:

$ drill @8.8.8.8 www.archlinux.org

To test a local name server (such as unbound) do:

$ drill @127.0.0.1 www.archlinux.org

Alternative DNS servers

To use alternative DNS servers, edit /etc/resolv.conf and add them at the top of the list so they are used first, optionally removing or commenting out other servers. Currently, you may include a maximum of three nameservers.

Note: Changes made to /etc/resolv.conf take effect immediately.
Tip: If you require more flexibility, e.g. more than three nameservers, you can use a local DNS resolver like dnsmasq or unbound. In this case the nameserver IP address will likely be 127.0.0.1.

Cisco Umbrella (formerly OpenDNS)

OpenDNS provided free alternative nameservers, was bought by Cisco in Nov. 2016 and continues to offer OpenDNS as end-user product of its "Umbrella" product suite with focus on Security Enforcement, Security Intelligence and Web Filtering. The old nameservers still work but are pre-configured to block adult content:

# OpenDNS IPv4 nameservers
nameserver 208.67.222.222
nameserver 208.67.220.220
# OpenDNS IPv6 nameservers
nameserver 2620:0:ccc::2
nameserver 2620:0:ccd::2

Cloudflare

Cloudflare provides a service committed to never writing the querying IP addresses to disk and wiping all logs within 24 hours, with the exception of providing data to APNIC labs for research purposes. APNIC and Cloudfare committed to treat all data with high privacy standards in their research agreement statement.

# IPv4 nameservers: 
nameserver 1.1.1.1
nameserver 1.0.0.1
# IPv6 nameservers:
nameserver 2606:4700:4700::1111
nameserver 2606:4700:4700::1001

Comodo

Comodo provides another IPv4 set, with optional (non-free) web-filtering. Implied in this feature is that the service hijacks the queries.

# Comodo nameservers 
nameserver 8.26.56.26 
nameserver 8.20.247.20

DNS.WATCH

DNS.WATCH focuses on neutrality and security and provides two servers located in Germany with no logging and with DNSSEC enabled. Note they welcome commercial sponsorship.

# dns.watch IPv4 nameservers
nameserver 84.200.69.80    # resolver1.dns.watch 
nameserver 84.200.70.40    # resolver2.dns.watch

Google

Google's nameservers can be used as an alternative:

# Google IPv4 nameservers
nameserver 8.8.8.8
nameserver 8.8.4.4
# Google IPv6 nameservers
nameserver 2001:4860:4860::8888
nameserver 2001:4860:4860::8844

OpenNIC

OpenNIC provides free uncensored nameservers located in multiple countries. The full list of public servers is available at servers.opennic.org and a shortlist of nearest nameservers for optimal performance is generated on their home page.

To retrieve a list of nearest nameservers, an API is also available and returns, based on the URL parameters provided, a list of nameservers in the desired format. For example to get the 200 nearest IPv4 servers, one can use https://api.opennicproject.org/geoip/?list&ipv=4&res=200&adm=0&bl&wl.

Alternatively, the anycast servers below can be used; while reliable their latency fluctuates a lot.

# OpenNIC IPv4 nameservers (Worldwide Anycast)
nameserver 185.121.177.177
nameserver 185.121.177.53
# OpenNIC IPv6 nameservers (Worldwide Anycast)
nameserver 2a05:dfc7:5::53
nameserver 2a05:dfc7:5::5353
Note:
  • The use of OpenNIC DNS servers will allow host name resolution in the traditional Top-Level Domain (TLD) registries, but also in OpenNIC or afiliated operated namespaces: .o, .libre, .dyn...
  • The tool opennic-up — automates the renewal of the DNS servers with the most responsive OpenNIC servers
https://github.com/kewlfft/opennic-up || opennic-upAUR

Quad9

Quad9 is a free DNS service founded by IBM, Packet Clearing House and Global Cyber Alliance; its primary unique feature is a blocklist which avoids resolving known malicious domains. The addresses below are worldwide anycast.

# Quad9 IPv4 nameservers
nameserver 9.9.9.9    ## "secure", with blocklist and DNSSEC
nameserver 9.9.9.10    ## no blocklist, no DNSSEC
# Quad9 IPv6 nameservers
nameserver 2620:fe::fe    ## "secure", with blocklist and DNSSEC
nameserver 2620:fe::10    ## no blocklist, no DNSSEC

UncensoredDNS

UncensoredDNS is a free uncensored DNS service. It is run by a private individual and consists in one anycast served by multiple servers and one unicast node hosted in Denmark.

# censurfridns.dk IPv4 nameservers
nameserver 91.239.100.100    ## anycast.censurfridns.dk
nameserver 89.233.43.71      ## unicast.censurfridns.dk
# censurfridns.dk IPv6 nameservers
nameserver 2001:67c:28a4::   ## anycast.censurfridns.dk
nameserver 2a01:3a0:53:53::  ## unicast.censurfridns.dk
Note: Its servers listen to port 5353 as well as the standard port 53. This can be used in case your ISP hijacks port 53.

Yandex

Yandex.DNS has servers in Russia, Eastern and Western Europe and has three options, Basic, Safe and Family:

# Basic Yandex.DNS - Quick and reliable DNS
nameserver 77.88.8.8              # Preferred IPv4 DNS
nameserver 77.88.8.1              # Alternate IPv4 DNS

nameserver 2a02:6b8::feed:0ff     # Preferred IPv6 DNS
nameserver 2a02:6b8:0:1::feed:0ff # Alternate IPv6 DNS
# Safe Yandex.DNS - Protection from virus and fraudulent content
nameserver 77.88.8.88             # Preferred IPv4 DNS
nameserver 77.88.8.2              # Alternate IPv4 DNS

nameserver 2a02:6b8::feed:bad     # Preferred IPv6 DNS
nameserver 2a02:6b8:0:1::feed:bad # Alternate IPv6 DNS
# Family Yandex.DNS - Without adult content
nameserver 77.88.8.7              # Preferred IPv4 DNS
nameserver 77.88.8.3              # Alternate IPv4 DNS

nameserver 2a02:6b8::feed:a11     # Preferred IPv6 DNS
nameserver 2a02:6b8:0:1::feed:a11 # Alternate IPv6 DNS

Yandex.DNS' speed is the same in the three modes. In Basic mode, there is no traffic filtering. In Safe mode, protection from infected and fraudulent sites is provided. Family mode enables protection from dangerous sites and blocks sites with adult content.

Preserve DNS settings

dhcpcd, netctl, NetworkManager, and various other processes can overwrite /etc/resolv.conf. This is usually desirable behavior, but sometimes DNS settings need to be set manually (e.g. when using a static IP address). There are several ways to accomplish this.

  • If you are using dhcpcd, see #Modify the dhcpcd config below.
  • If you are using netctl and static IP address assignment, do not use the DNS* options in your profile, otherwise resolvconf is called and /etc/resolv.conf overwritten.

Systemd-resolved configuration

systemd-resolved(8) is a systemd service that provides network name resolution to local applications. systemd-resolved has four different modes for handling resolv.conf. In one of the modes, it is a consumer of the /etc/resolv.conf file and any change made to it is going to be preserved and taken into account transparently for the user. This mode is therefore compatible with the procedures described in this page.

However, this is not systemd-resolved's recommended mode of operation. The service users are advised to redirect software which read the /etc/resolv.conf file to the local stub DNS resolver managed by systemd-resolved. This can be done by deleting or renaming the existing /etc/resolv.conf and replacing it by a symbolic link to the systemd stub:
ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf

In this mode, the DNS servers are provided in the resolved.conf(5) file. In order to check the DNS actually used by systemd-resolved, the command to use is:

$ systemd-resolve --status
Tip: To understand the context around the DNS choices and switches, one can turn on detailed debug information for systemd-resolved as described in Systemd#Diagnosing a service.

Prevent NetworkManager modifications

To stop NetworkManager from modifying /etc/resolv.conf, edit /etc/NetworkManager/NetworkManager.conf and add the following in the [main] section:

dns=none

/etc/resolv.conf might be a broken symlink that you will need to remove after doing that. Then, just create a new /etc/resolv.conf file.

NetworkManager also offers hooks via so called dispatcher scripts that can be used to alter the /etc/resolv.conf after network changes. See NetworkManager#Network services with NetworkManager dispatcher and NetworkManager(8) for more information.

Use openresolv

openresolv provides a utility resolvconf, which is a framework for managing multiple DNS configurations. See resolvconf(8) and resolvconf.conf(5) for more information.

The configuration is done in /etc/resolvconf.conf and running resolvconf -u will generate /etc/resolv.conf.

Note that NetworkManager can be configured to use openresolv, see NetworkManager#Configure NetworkManager resolv.conf management mode to use resolvconf.

Modify the dhcpcd config

dhcpcd's configuration file may be edited to prevent the dhcpcd daemon from overwriting /etc/resolv.conf. To do this, add the following to the last section of /etc/dhcpcd.conf:

nohook resolv.conf

Alternatively, you can create a file called /etc/resolv.conf.head containing your DNS servers. dhcpcd will prepend this file to the beginning of /etc/resolv.conf.

Or you can configure dhcpcd to use the same DNS servers every time. To do this, add the following line at the end of your /etc/dhcpcd.conf, where dns-server-ip-addressses is a space separated list of DNS IP addresses.

static domain_name_servers=dns-server-ip-addresses

For example, to set it to Google's DNS servers:

static domain_name_servers=8.8.8.8 8.8.4.4

Write-protect resolv.conf

Another way to protect your /etc/resolv.conf from being modified by anything is setting the immutable (write-protection) attribute:

# chattr +i /etc/resolv.conf

Tips and tricks

Limit lookup time

If you are confronted with a very long hostname lookup (may it be in pacman or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in /etc/resolv.conf.

options timeout:1

Hostname lookup delayed with IPv6

If you experience a 5 second delay when resolving hostnames it might be due to a DNS-server/Firewall misbehaving and only giving one reply to a parallel A and AAAA request (source). You can fix that by setting the following option in /etc/resolv.conf:

options single-request

Local domain names

If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to resolv.conf with the local domain such as:

domain example.com

That way you can refer to local hosts such as mainmachine1.example.com as simply mainmachine1 when using the ssh command, but the drill command still requires the fully qualified domain names in order to perform lookups.