Difference between revisions of "Resolv.conf"

From ArchWiki
Jump to: navigation, search
(wikify some external links, use https for archlinux.org)
m (Tips and tricks: replaced "localdomain.com" with "example.com" RFC6761 specifically reserves this name for use in documentation)
 
(69 intermediate revisions by 29 users not shown)
Line 1: Line 1:
[[Category:Networking]]
+
{{Lowercase title}}
[[es:Resolv.conf]]
+
[[Category:Domain Name System]]
 
[[de:Resolv.conf]]
 
[[de:Resolv.conf]]
 +
[[es:Resolv.conf]]
 +
[[fr:Resolv.conf]]
 
[[it:Resolv.conf]]
 
[[it:Resolv.conf]]
 +
[[ja:Resolv.conf]]
 
[[zh-CN:Resolv.conf]]
 
[[zh-CN:Resolv.conf]]
From from the [http://www.kernel.org/doc/man-pages/online/pages/man5/resolv.conf.5.html resolv.conf(5)] man page:
+
{{Related articles start}}
:''"The  resolver  is a set of routines in the C library that provide access to the Internet Domain Name System (DNS).  The resolver configuration file contains information that is read by the resolver routines the first time they are invoked by a process.  The file is designed to be human readable and contains a list of keywords with values that provide various types of resolver information.''
+
{{Related|Improving performance#Network}}
 +
{{Related articles end}}
  
:''"On  a  normally  configured  system this file should not be necessary. The only name server to be queried will be on the local machine; the domain name is determined from the host name and the domain search path is constructed from the domain name."''
+
The configuration file for DNS resolvers is {{ic|/etc/resolv.conf}}. From its [http://www.kernel.org/doc/man-pages/online/pages/man5/resolv.conf.5.html man page]:
 +
:The resolver is a set of routines in the C library that provide access to the Internet Domain Name System (DNS). The resolver configuration file contains information that is read by the resolver routines the first time they are invoked by a process. The file is designed to be human readable and contains a list of keywords with values that provide various types of resolver information.
  
==Preserve DNS settings==
+
:If this file does not exist, only the name server on the local machine will be queried; the domain name is determined from the hostname and the domain search path is constructed from the domain name.
{{Pkg|dhcpcd}}, [[NetworkManager]], and various other processes can overwrite {{ic|/etc/resolv.conf}}. This is usually desirable behavior, but sometimes DNS settings need to be set manually (e.g. when using a static IP address). There are several ways to accomplish this. If you are using NetworkManager, see [https://bbs.archlinux.org/viewtopic.php?id=45394 this thread] on how to prevent it from overriding your {{ic|/etc/resolv.conf}}.
+
  
===Modify the dhcpcd Config===
+
== DNS in Linux ==
dhcpcd's configuration file may be edited to prevent the dhcpcd daemon from overwriting {{ic|/etc/resolv.conf}}. To do this, add the following to the last section of {{ic|/etc/dhcpcd.conf}}:
+
  
  nohook resolv.conf
+
Your ISP (usually) provides working [[wikipedia:Domain_Name_System|DNS]] servers, and a router may also add an extra DNS server in case you have your own cache server. Switching between DNS servers does not represent a problem for Windows users, because if a DNS server is slow or does not work it will immediately switch to a better one. However, Linux usually takes longer to timeout, which could be the reason why you are getting a delay.
  
===Use resolv.conf.head===
+
=== Testing ===
Alternatively, you can create a file called {{ic|/etc/resolv.conf.head}} containing your DNS servers. dhcpcd will prepend this file to the beginning of {{ic|/etc/resolv.conf}}. An example {{ic|/etc/resolv.conf.head}} for someone using [[OpenDNS]] would be:
+
  
  # OpenDNS servers
+
Use ''drill'' (provided by package {{Pkg|ldns}}) before any changes, repeat after making the adjustments and compare the query time(s). The following command uses the nameservers set in {{ic|/etc/resolv.conf}}:
 +
$ drill www5.yahoo.com
 +
 
 +
You can also specify a specific nameserver's ip address, bypassing the settings in your {{ic|/etc/resolv.conf}}:
 +
 
 +
$ drill @''ip.of.name.server'' www5.yahoo.com
 +
 
 +
For example to test Google's name servers:
 +
 
 +
$ drill @8.8.8.8 www5.yahoo.com
 +
 
 +
To test a local name server (such as [[unbound]]) do:
 +
 
 +
$ drill @127.0.0.1 www5.yahoo.com
 +
 
 +
== Alternative DNS servers ==
 +
 
 +
To use alternative DNS servers, edit {{ic|/etc/resolv.conf}} and add them to the top of the file so they are used first, optionally removing or commenting out already listed servers. Currently, you may include a maximum of three {{ic|nameserver}} lines.
 +
 
 +
{{Note|Changes made to {{ic|/etc/resolv.conf}} take effect immediately.}}
 +
 
 +
{{Tip|If you require more flexibility, e.g. more than three nameservers, you can use a locally caching nameserver/resolver like [[dnsmasq]] or [[unbound]]. Using a local DNS caching resolver, most likely you will not set the {{ic|nameserver}} to the actual DNS server but to {{ic|127.0.0.1}}. See the article for the program you are using for DNS caching.}}
 +
 
 +
=== OpenNIC ===
 +
 
 +
[http://www.opennicproject.org/ OpenNIC] provides free uncensored nameservers with additional features.
 +
 
 +
{{Tip|OpenNIC offers many [http://wiki.opennicproject.org/Tier2 different nameservers] located in multiple countries. Pick some of the [http://www.opennicproject.org/nearest-servers/ nearest nameservers] for optimal performance.}}
 +
 
 +
  # OpenNIC IPv4 nameservers (US)
 +
nameserver 107.170.95.180
 +
nameserver 75.127.14.107
 +
 
 +
=== OpenDNS ===
 +
 
 +
[https://opendns.com OpenDNS] provides free alternative nameservers:
 +
 
 +
# OpenDNS IPv4 nameservers
 
  nameserver 208.67.222.222
 
  nameserver 208.67.222.222
 
  nameserver 208.67.220.220
 
  nameserver 208.67.220.220
  
If you are not pleased with the OpenDNS servers, you might try [https://developers.google.com/speed/public-dns/ Google's nameservers] as an alternative.
+
# OpenDNS IPv6 nameservers
  # Google nameservers
+
nameserver 2620:0:ccc::2
 +
nameserver 2620:0:ccd::2
 +
 
 +
=== Google ===
 +
 
 +
[https://developers.google.com/speed/public-dns/ Google's nameservers] can be used as an alternative:
 +
 
 +
  # Google IPv4 nameservers
 
  nameserver 8.8.8.8
 
  nameserver 8.8.8.8
 
  nameserver 8.8.4.4
 
  nameserver 8.8.4.4
  
===Write-protect /etc/resolv.conf===
+
# Google IPv6 nameservers
Another way to protect your {{ic|/etc/resolv.conf}} from being modified by anything is setting the write-protection attribute:
+
nameserver 2001:4860:4860::8888
  chattr +i /etc/resolv.conf
+
nameserver 2001:4860:4860::8844
 +
 
 +
=== Comodo ===
 +
[http://securedns.dnsbycomodo.com/ Comodo] provides another IPv4 set, with optional (non-free) web-filtering. Implied in this feature is that the service hijacks the queries.
 +
 
 +
# Comodo nameservers
 +
nameserver 8.26.56.26
 +
nameserver 8.20.247.20
 +
 
 +
=== Yandex ===
 +
[https://dns.yandex.com/advanced/ Yandex.DNS] have three options:
 +
 
 +
# Basic Yandex.DNS - Quick and reliable DNS
 +
nameserver 77.88.8.8              # Preferred IPv4 DNS
 +
nameserver 77.88.8.1              # Alternate IPv4 DNS
 +
 +
nameserver 2a02:6b8::feed:0ff    # Preferred IPv6 DNS
 +
nameserver 2a02:6b8:0:1::feed:0ff # Alternate IPv6 DNS
 +
 
 +
# Safe Yandex.DNS - Protection from virus and fraudulent content
 +
nameserver 77.88.8.88            # Preferred IPv4 DNS
 +
nameserver 77.88.8.2              # Alternate IPv4 DNS
 +
 +
nameserver 2a02:6b8::feed:bad    # Preferred IPv6 DNS
 +
nameserver 2a02:6b8:0:1::feed:bad # Alternate IPv6 DNS
 +
 
 +
# Family Yandex.DNS - Without adult content
 +
nameserver 77.88.8.7              # Preferred IPv4 DNS
 +
nameserver 77.88.8.3              # Alternate IPv4 DNS
 +
 +
nameserver 2a02:6b8::feed:a11    # Preferred IPv6 DNS
 +
nameserver 2a02:6b8:0:1::feed:a11 # Alternate IPv6 DNS
 +
 
 +
Yandex.DNS' speed is the same in all three modes. In "Basic" mode, there is no traffic filtering. In "Safe" mode, protection from infected and fraudulent sites is provided. "Family" mode enables protection from dangerous sites and blocks sites with adult content.
 +
 
 +
=== UncensoredDNS ===
 +
 
 +
[http://censurfridns.dk UncensoredDNS] is a free uncensored DNS resolver who also answers queries on port 5353 if you are behind a firewall blocking outgoing port 53.
 +
 
 +
# censurfridns.dk IPv4 nameservers
 +
nameserver 91.239.100.100    ## anycast.censurfridns.dk
 +
nameserver 89.233.43.71      ## ns1.censurfridns.dk
 +
 
 +
# censurfridns.dk IPv6 nameservers
 +
nameserver 2001:67c:28a4::            ## anycast.censurfridns.dk
 +
nameserver 2002:d596:2a92:1:71:53::    ## ns1.censurfridns.dk
 +
 
 +
== Preserve DNS settings ==
 +
 
 +
[[dhcpcd]], [[netctl]], [[NetworkManager]], and various other processes can overwrite {{ic|/etc/resolv.conf}}. This is usually desirable behavior, but sometimes DNS settings need to be set manually (e.g. when using a static IP address). There are several ways to accomplish this.
 +
*If you are using ''dhcpcd'', see [[#Modify the dhcpcd config]] below.
 +
*If you are using [[netctl]] and static IP address assignment, do not use the {{ic|DNS*}} options in your profile, otherwise ''resolvconf'' is called and {{ic|/etc/resolv.conf}} overwritten.
 +
 
 +
=== With NetworkManager===
 +
 
 +
To stop NetworkManager from modifying {{ic|/etc/resolv.conf}}, edit {{ic|/etc/NetworkManager/NetworkManager.conf}} and add the following in the {{ic|[main]}} section:
 +
 
 +
dns=none
 +
 
 +
{{ic|/etc/resolv.conf}} might be a broken symlink that you will need to remove after doing that. Then, just create a new {{ic|/etc/resolv.conf}} file.
 +
 
 +
=== Using openresolv ===
 +
 
 +
{{Pkg|openresolv}} provides a utility ''resolvconf'', which is a framework for managing multiple DNS configurations. See {{ic|man 8 resolvconf}} and {{ic|man 5 resolvconf.conf}} for more information.
 +
 
 +
The configuration is done in {{ic|/etc/resolvconf.conf}} and running {{ic|resolvconf -u}} will generate {{ic|/etc/resolv.conf}}.
 +
 
 +
=== Modify the dhcpcd config ===
 +
 
 +
''dhcpcd'''s configuration file may be edited to prevent the ''dhcpcd'' daemon from overwriting {{ic|/etc/resolv.conf}}. To do this, add the following to the last section of {{ic|/etc/dhcpcd.conf}}:
 +
 
 +
nohook resolv.conf
 +
 
 +
Alternatively, you can create a file called {{ic|/etc/resolv.conf.head}} containing your DNS servers. ''dhcpcd'' will prepend this file to the beginning of {{ic|/etc/resolv.conf}}.
 +
 
 +
Or you can configure dhcpcd to use the same DNS servers every time. To do this, add the following line at the end of your {{ic|/etc/dhcpcd.conf}}:
 +
 
 +
static domain_name_servers=8.8.4.4 8.8.8.8
 +
 
 +
=== Write-protect /etc/resolv.conf ===
 +
 
 +
Another way to protect your {{ic|/etc/resolv.conf}} from being modified by anything is setting the immutable (write-protection) attribute:
 +
 
 +
  # chattr +i /etc/resolv.conf
 +
 
 +
=== Use timeout option to reduce hostname lookup time ===
 +
 
 +
If you are confronted with a very long hostname lookup (may it be in [[pacman]] or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in {{ic|/etc/resolv.conf}}.
  
===Use timeout option to reduce hostname lookup time===
 
If you are confronted with a very long hostname lookup (may it be in [[pacman]] or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, create a file called {{ic|/etc/resolv.conf.tail}} and add the following line:
 
 
  options timeout:1
 
  options timeout:1
  
Then restart your network daemon and see if it works better.
+
== Tips and tricks ==
 +
 
 +
=== Local domain names ===
 +
 
 +
If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to {{ic|resolv.conf}} with the local domain such as:
 +
 
 +
domain example.com
 +
 
 +
That way you can refer to local hosts such as {{ic|mainmachine1.example.com}} as simply {{ic|mainmachine1}} when using the ''ssh'' command, but the ''drill'' command still requires the fully qualified domain names in order to perform lookups.

Latest revision as of 22:59, 29 September 2016

The configuration file for DNS resolvers is /etc/resolv.conf. From its man page:

The resolver is a set of routines in the C library that provide access to the Internet Domain Name System (DNS). The resolver configuration file contains information that is read by the resolver routines the first time they are invoked by a process. The file is designed to be human readable and contains a list of keywords with values that provide various types of resolver information.
If this file does not exist, only the name server on the local machine will be queried; the domain name is determined from the hostname and the domain search path is constructed from the domain name.

DNS in Linux

Your ISP (usually) provides working DNS servers, and a router may also add an extra DNS server in case you have your own cache server. Switching between DNS servers does not represent a problem for Windows users, because if a DNS server is slow or does not work it will immediately switch to a better one. However, Linux usually takes longer to timeout, which could be the reason why you are getting a delay.

Testing

Use drill (provided by package ldns) before any changes, repeat after making the adjustments and compare the query time(s). The following command uses the nameservers set in /etc/resolv.conf:

$ drill www5.yahoo.com

You can also specify a specific nameserver's ip address, bypassing the settings in your /etc/resolv.conf:

$ drill @ip.of.name.server www5.yahoo.com

For example to test Google's name servers:

$ drill @8.8.8.8 www5.yahoo.com

To test a local name server (such as unbound) do:

$ drill @127.0.0.1 www5.yahoo.com

Alternative DNS servers

To use alternative DNS servers, edit /etc/resolv.conf and add them to the top of the file so they are used first, optionally removing or commenting out already listed servers. Currently, you may include a maximum of three nameserver lines.

Note: Changes made to /etc/resolv.conf take effect immediately.
Tip: If you require more flexibility, e.g. more than three nameservers, you can use a locally caching nameserver/resolver like dnsmasq or unbound. Using a local DNS caching resolver, most likely you will not set the nameserver to the actual DNS server but to 127.0.0.1. See the article for the program you are using for DNS caching.

OpenNIC

OpenNIC provides free uncensored nameservers with additional features.

Tip: OpenNIC offers many different nameservers located in multiple countries. Pick some of the nearest nameservers for optimal performance.
# OpenNIC IPv4 nameservers (US)
nameserver 107.170.95.180
nameserver 75.127.14.107

OpenDNS

OpenDNS provides free alternative nameservers:

# OpenDNS IPv4 nameservers
nameserver 208.67.222.222
nameserver 208.67.220.220
# OpenDNS IPv6 nameservers
nameserver 2620:0:ccc::2
nameserver 2620:0:ccd::2

Google

Google's nameservers can be used as an alternative:

# Google IPv4 nameservers
nameserver 8.8.8.8
nameserver 8.8.4.4
# Google IPv6 nameservers
nameserver 2001:4860:4860::8888
nameserver 2001:4860:4860::8844

Comodo

Comodo provides another IPv4 set, with optional (non-free) web-filtering. Implied in this feature is that the service hijacks the queries.

# Comodo nameservers 
nameserver 8.26.56.26 
nameserver 8.20.247.20

Yandex

Yandex.DNS have three options:

# Basic Yandex.DNS - Quick and reliable DNS
nameserver 77.88.8.8              # Preferred IPv4 DNS
nameserver 77.88.8.1              # Alternate IPv4 DNS

nameserver 2a02:6b8::feed:0ff     # Preferred IPv6 DNS
nameserver 2a02:6b8:0:1::feed:0ff # Alternate IPv6 DNS
# Safe Yandex.DNS - Protection from virus and fraudulent content
nameserver 77.88.8.88             # Preferred IPv4 DNS
nameserver 77.88.8.2              # Alternate IPv4 DNS

nameserver 2a02:6b8::feed:bad     # Preferred IPv6 DNS
nameserver 2a02:6b8:0:1::feed:bad # Alternate IPv6 DNS
# Family Yandex.DNS - Without adult content
nameserver 77.88.8.7              # Preferred IPv4 DNS
nameserver 77.88.8.3              # Alternate IPv4 DNS

nameserver 2a02:6b8::feed:a11     # Preferred IPv6 DNS
nameserver 2a02:6b8:0:1::feed:a11 # Alternate IPv6 DNS

Yandex.DNS' speed is the same in all three modes. In "Basic" mode, there is no traffic filtering. In "Safe" mode, protection from infected and fraudulent sites is provided. "Family" mode enables protection from dangerous sites and blocks sites with adult content.

UncensoredDNS

UncensoredDNS is a free uncensored DNS resolver who also answers queries on port 5353 if you are behind a firewall blocking outgoing port 53.

# censurfridns.dk IPv4 nameservers
nameserver 91.239.100.100    ## anycast.censurfridns.dk
nameserver 89.233.43.71      ## ns1.censurfridns.dk
# censurfridns.dk IPv6 nameservers
nameserver 2001:67c:28a4::             ## anycast.censurfridns.dk
nameserver 2002:d596:2a92:1:71:53::    ## ns1.censurfridns.dk

Preserve DNS settings

dhcpcd, netctl, NetworkManager, and various other processes can overwrite /etc/resolv.conf. This is usually desirable behavior, but sometimes DNS settings need to be set manually (e.g. when using a static IP address). There are several ways to accomplish this.

  • If you are using dhcpcd, see #Modify the dhcpcd config below.
  • If you are using netctl and static IP address assignment, do not use the DNS* options in your profile, otherwise resolvconf is called and /etc/resolv.conf overwritten.

With NetworkManager

To stop NetworkManager from modifying /etc/resolv.conf, edit /etc/NetworkManager/NetworkManager.conf and add the following in the [main] section:

dns=none

/etc/resolv.conf might be a broken symlink that you will need to remove after doing that. Then, just create a new /etc/resolv.conf file.

Using openresolv

openresolv provides a utility resolvconf, which is a framework for managing multiple DNS configurations. See man 8 resolvconf and man 5 resolvconf.conf for more information.

The configuration is done in /etc/resolvconf.conf and running resolvconf -u will generate /etc/resolv.conf.

Modify the dhcpcd config

dhcpcd's configuration file may be edited to prevent the dhcpcd daemon from overwriting /etc/resolv.conf. To do this, add the following to the last section of /etc/dhcpcd.conf:

nohook resolv.conf

Alternatively, you can create a file called /etc/resolv.conf.head containing your DNS servers. dhcpcd will prepend this file to the beginning of /etc/resolv.conf.

Or you can configure dhcpcd to use the same DNS servers every time. To do this, add the following line at the end of your /etc/dhcpcd.conf:

static domain_name_servers=8.8.4.4 8.8.8.8

Write-protect /etc/resolv.conf

Another way to protect your /etc/resolv.conf from being modified by anything is setting the immutable (write-protection) attribute:

# chattr +i /etc/resolv.conf

Use timeout option to reduce hostname lookup time

If you are confronted with a very long hostname lookup (may it be in pacman or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in /etc/resolv.conf.

options timeout:1

Tips and tricks

Local domain names

If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to resolv.conf with the local domain such as:

domain example.com

That way you can refer to local hosts such as mainmachine1.example.com as simply mainmachine1 when using the ssh command, but the drill command still requires the fully qualified domain names in order to perform lookups.