Difference between revisions of "Domain name resolution"

From ArchWiki
Jump to: navigation, search
m (added ja)
m (fix French typo)
 
(254 intermediate revisions by 40 users not shown)
Line 1: Line 1:
 
[[Category:Domain Name System]]
 
[[Category:Domain Name System]]
 +
[[Category:Network configuration]]
 +
[[de:Resolv.conf]]
 
[[es:Resolv.conf]]
 
[[es:Resolv.conf]]
[[de:Resolv.conf]]
 
 
[[fr:Resolv.conf]]
 
[[fr:Resolv.conf]]
 
[[it:Resolv.conf]]
 
[[it:Resolv.conf]]
 
[[ja:Resolv.conf]]
 
[[ja:Resolv.conf]]
[[zh-CN:Resolv.conf]]
+
[[pt:Domain name resolution]]
From from the [http://www.kernel.org/doc/man-pages/online/pages/man5/resolv.conf.5.html resolv.conf(5)] man page:
+
[[zh-hans:Resolv.conf]]
:''"The  resolver is a set of routines in the C library that provide access to the Internet Domain Name System (DNS).  The resolver configuration file contains information that is read by the resolver routines the first time they are invoked by a process.  The file is designed to be human readable and contains a list of keywords with values that provide various types of resolver information.''
+
{{Related articles start}}
 +
{{Related|Alternative DNS services}}
 +
{{Related|Network configuration}}
 +
{{Related articles end}}
 +
In general, a [[Wikipedia:Domain name|domain name]] represents an IP address and is associated to it in the [[Wikipedia:Domain Name System|Domain Name System]] (DNS).
 +
This article explains how to configure domain name resolution and resolve domain names.
 +
 
 +
== Name Service Switch ==
 +
:''"NSS" redirects here. For Mozilla cryptographic libraries, see [[Network Security Services]].''
 +
 
 +
The [[Wikipedia:Name Service Switch|Name Service Switch]] (NSS) facility is part of the GNU C Library ({{Pkg|glibc}}) and backs the {{man|3|getaddrinfo}} API, used to resolve domain names. NSS allows system databases to be provided by separate services, whose search order can be configured by the administrator in {{man|5|nsswitch.conf}}. The database responsible for domain name resolution is the {{ic|hosts}} database, for which glibc offers the following services:
 +
 
 +
* {{ic|file}}: reads the {{ic|/etc/hosts}} file, see {{man|5|hosts}}
 +
* {{ic|dns}}: the [[#Glibc resolver|glibc resolver]] which reads {{ic|/etc/resolv.conf}}, see {{man|5|resolv.conf}}
 +
 
 +
[[Systemd]] provides three NSS services for hostname resolution:
 +
 
 +
* {{man|8|nss-resolve}} - a caching DNS stub resolver, described in [[#Systemd-resolved]]
 +
* {{man|8|nss-myhostname}} - provides hostname resolution without having to edit {{ic|/etc/hosts}}, described in [[Network configuration#Local hostname resolution]]
 +
* {{man|8|nss-mymachines}} - provides hostname resolution for the names of local {{man|8|systemd-machined}} containers
 +
 
 +
=== Check if you can resolve domain names ===
 +
 
 +
NSS databases can be queried with {{man|1|getent}}. You can resolve a domain name through NSS using:
 +
 
 +
$ getent hosts ''domain_name''
  
:''"On  a  normally  configured  system this file should not be necessary. The only name server to be queried will be on the local machine; the domain name is determined from the host name and the domain search path is constructed from the domain name."''
+
{{Note|While most programs resolve domain names using NSS, some may read {{ic|resolv.conf}} and/or {{ic|/etc/hosts}} directly. See [[Network configuration#Local hostname resolution]].}}
  
==Preserve DNS settings==
+
== Glibc resolver ==
{{Pkg|dhcpcd}}, [[NetworkManager]], and various other processes can overwrite {{ic|/etc/resolv.conf}}. This is usually desirable behavior, but sometimes DNS settings need to be set manually (e.g. when using a static IP address). There are several ways to accomplish this. If you are using NetworkManager, see [https://bbs.archlinux.org/viewtopic.php?id=45394 this thread] on how to prevent it from overriding your {{ic|/etc/resolv.conf}}.
 
  
===Modify the dhcpcd Config===
+
The glibc resolver reads {{ic|/etc/resolv.conf}} for every resolution to determine the nameservers and options to use.  
dhcpcd's configuration file may be edited to prevent the dhcpcd daemon from overwriting {{ic|/etc/resolv.conf}}. To do this, add the following to the last section of {{ic|/etc/dhcpcd.conf}}:
 
  
nohook resolv.conf
+
{{man|5|resolv.conf}} lists nameservers together with some configuration options.
 +
Nameservers listed first are tried first, up to three nameservers may be listed. Lines starting with a number sign are ignored.
  
===Use resolv.conf.head===
+
{{Note|The glibc resolver does not cache queries. See [[#Performance]] for more information.}}
Alternatively, you can create a file called {{ic|/etc/resolv.conf.head}} containing your DNS servers. dhcpcd will prepend this file to the beginning of {{ic|/etc/resolv.conf}}. An example {{ic|/etc/resolv.conf.head}} for someone using [[OpenDNS]] would be:
 
  
# OpenDNS servers
+
=== Overwriting of resolv.conf ===
nameserver 208.67.222.222
 
nameserver 208.67.220.220
 
  
If you are not pleased with the OpenDNS servers, you might try [https://developers.google.com/speed/public-dns/ Google's nameservers] as an alternative.
+
[[Network manager]]s tend to overwrite {{ic|resolv.conf}}, for specifics see the corresponding section:
# Google nameservers
 
nameserver 8.8.8.8
 
nameserver 8.8.4.4
 
  
=== Write-protect /etc/resolv.conf ===
+
* [[dhcpcd#resolv.conf]]
 +
* [[netctl#resolv.conf]]
 +
* [[NetworkManager#resolv.conf]]
  
Another way to protect your {{ic|/etc/resolv.conf}} from being modified by anything is setting the write-protection attribute:
+
To prevent programs from overwriting {{ic|resolv.conf}} you can also write-protect it by setting the immutable [[file attribute]].
# chattr +i /etc/resolv.conf
+
 
 +
{{Tip|If you want multiple processes to write to {{ic|resolv.conf}}, you can use [[openresolv]].}}
 +
 
 +
=== Limit lookup time ===
 +
 
 +
If you are confronted with a very long hostname lookup (may it be in [[pacman]] or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in {{ic|/etc/resolv.conf}}.
  
===Use timeout option to reduce hostname lookup time===
 
If you are confronted with a very long hostname lookup (may it be in [[pacman]] or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, create a file called {{ic|/etc/resolv.conf.tail}} and add the following line:
 
 
  options timeout:1
 
  options timeout:1
  
Then restart your network daemon and see if it works better.
+
=== Hostname lookup delayed with IPv6 ===
 +
 
 +
If you experience a 5 second delay when resolving hostnames it might be due to a DNS-server/Firewall misbehaving and only giving one reply to a parallel A and AAAA request ([http://udrepper.livejournal.com/20948.html source]).
 +
You can fix that by setting the following option in {{ic|/etc/resolv.conf}}:
 +
 
 +
options single-request
 +
 
 +
=== Local domain names ===
 +
 
 +
If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to {{ic|resolv.conf}} with the local domain such as:
 +
 
 +
domain example.com
 +
 
 +
That way you can refer to local hosts such as {{ic|mainmachine1.example.com}} as simply {{ic|mainmachine1}} when using the ''ssh'' command, but the ''drill'' command still requires the fully qualified domain names in order to perform lookups.
 +
 
 +
== Systemd-resolved ==
 +
 
 +
{{man|8|systemd-resolved}} is a [[systemd]] service that provides network name resolution to local applications via a [[D-Bus]] interface, the {{ic|resolve}} NSS service ({{man|8|nss-resolve}}), and a local DNS stub listener on {{ic|127.0.0.53}}.
 +
 
 +
''systemd-resolved'' has four different modes for handling the [[#Glibc resolver|glibc resolver]]'s ''resolv.conf'' (described in {{man|8|systemd-resolved|/ETC/RESOLV.CONF}}). We will focus here on the two most relevant modes.
 +
 
 +
# The mode in which ''systemd-resolved'' is a client of the {{ic|/etc/resolv.conf}}. This mode preserves {{ic|/etc/resolv.conf}} and is '''compatible''' with the procedures described in this page.
 +
# The ''systemd-resolved'''s '''recommended''' mode of operation: the DNS stub file as indicated below contains both the local stub {{ic|127.0.0.53}} as the only DNS servers and a list of search domains.
 +
 
 +
{{hc|/run/systemd/resolve/stub-resolv.conf|
 +
nameserver 127.0.0.53
 +
search lan
 +
}}
 +
 
 +
The service users are advised to redirect the {{ic|/etc/resolv.conf}} file to the local stub DNS resolver file {{ic|/run/systemd/resolve/stub-resolv.conf}} managed by ''systemd-resolved''. This propagates the systemd managed configuration to all the clients. This can be done by deleting or renaming the existing {{ic|/etc/resolv.conf}} and replacing it by a symbolic link to the systemd stub:
 +
 
 +
# ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
 +
 
 +
In this mode, the DNS servers are provided in the {{man|5|resolved.conf}} file:
 +
 
 +
{{hc|/etc/systemd/resolved.conf|2=
 +
[Resolve]
 +
'''DNS=91.239.100.100 89.233.43.71'''
 +
...
 +
}}
 +
 
 +
In order to check the DNS actually used by ''systemd-resolved'', the command to use is:
 +
 
 +
$ systemd-resolve --status
 +
 
 +
{{Tip|
 +
* To understand the context around the DNS choices and switches, one can turn on detailed debug information for ''systemd-resolved'' as described in [[Systemd#Diagnosing a service]].
 +
* The mode of operation of ''systemd-resolved'' is detected automatically, depending on whether {{ic|/etc/resolv.conf}} is a symlink to the local stub DNS resolver file or contains server names.
 +
}}
 +
 
 +
== Performance ==
 +
 
 +
The [[#Glibc resolver]] does not cache queries. If you want local caching use [[#Systemd-resolved]] or set up a local caching [[DNS server]] and use {{ic|127.0.0.1}}.
 +
 
 +
{{Tip|The ''dig'' and ''drill'' [[#Lookup utilities]] report the query time.}}
 +
 
 +
Internet service providers usually provide working DNS servers. A router may also add an extra DNS server in case it has its own cache server. Switching between DNS servers is transparent for Windows users, because if a DNS server is slow or does not work it will immediately switch to a better one. However, Linux usually takes longer to timeout, which could cause delays.
 +
 
 +
== Privacy ==
 +
 
 +
Most DNS servers keep a log of IP addresses and sites visited on a more or less temporary basis. The data collected can be used to perform various statistical studies. Personally-identifying information have value and can also be rented or sold to third parties. [[Alternative DNS services]] provides a list of popular services, check their privacy policy for information about how user data is handled.
 +
 
 +
== Lookup utilities ==
 +
 
 +
To query specific DNS servers and DNS/[[DNSSEC]] records you can use dedicated DNS lookup utilities. These tools implement DNS themselves and do not use [[#Name Service Switch|NSS]].
 +
 
 +
* {{Pkg|bind-tools}} provides {{man|1|dig}}, {{man|1|host}}, {{man|1|nslookup}} and a bunch of {{ic|dnssec-}} tools.
 +
* {{Pkg|ldns}} provides {{man|1|drill}}, which is similar to ''dig''
 +
 
 +
For example, to query a specific nameserver with drill for the TXT records of a domain:
 +
 
 +
$ drill @''nameserver'' TXT ''domain''
 +
 
 +
If you do not specify a DNS server ''dig'' and ''drill'' use the nameservers defined in {{ic|/etc/resolv.conf}}.
 +
 
 +
== See also ==
 +
 
 +
* [https://www.tldp.org/LDP/nag2/x-087-2-resolv.html Linux Network Administrators Guide]
 +
* [https://www.debian.org/doc/manuals/debian-handbook/sect.hostname-name-service.en.html#sect.name-resolution Debian Handbook]

Latest revision as of 08:10, 21 June 2018

In general, a domain name represents an IP address and is associated to it in the Domain Name System (DNS). This article explains how to configure domain name resolution and resolve domain names.

Name Service Switch

"NSS" redirects here. For Mozilla cryptographic libraries, see Network Security Services.

The Name Service Switch (NSS) facility is part of the GNU C Library (glibc) and backs the getaddrinfo(3) API, used to resolve domain names. NSS allows system databases to be provided by separate services, whose search order can be configured by the administrator in nsswitch.conf(5). The database responsible for domain name resolution is the hosts database, for which glibc offers the following services:

Systemd provides three NSS services for hostname resolution:

Check if you can resolve domain names

NSS databases can be queried with getent(1). You can resolve a domain name through NSS using:

$ getent hosts domain_name
Note: While most programs resolve domain names using NSS, some may read resolv.conf and/or /etc/hosts directly. See Network configuration#Local hostname resolution.

Glibc resolver

The glibc resolver reads /etc/resolv.conf for every resolution to determine the nameservers and options to use.

resolv.conf(5) lists nameservers together with some configuration options. Nameservers listed first are tried first, up to three nameservers may be listed. Lines starting with a number sign are ignored.

Note: The glibc resolver does not cache queries. See #Performance for more information.

Overwriting of resolv.conf

Network managers tend to overwrite resolv.conf, for specifics see the corresponding section:

To prevent programs from overwriting resolv.conf you can also write-protect it by setting the immutable file attribute.

Tip: If you want multiple processes to write to resolv.conf, you can use openresolv.

Limit lookup time

If you are confronted with a very long hostname lookup (may it be in pacman or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in /etc/resolv.conf.

options timeout:1

Hostname lookup delayed with IPv6

If you experience a 5 second delay when resolving hostnames it might be due to a DNS-server/Firewall misbehaving and only giving one reply to a parallel A and AAAA request (source). You can fix that by setting the following option in /etc/resolv.conf:

options single-request

Local domain names

If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to resolv.conf with the local domain such as:

domain example.com

That way you can refer to local hosts such as mainmachine1.example.com as simply mainmachine1 when using the ssh command, but the drill command still requires the fully qualified domain names in order to perform lookups.

Systemd-resolved

systemd-resolved(8) is a systemd service that provides network name resolution to local applications via a D-Bus interface, the resolve NSS service (nss-resolve(8)), and a local DNS stub listener on 127.0.0.53.

systemd-resolved has four different modes for handling the glibc resolver's resolv.conf (described in systemd-resolved(8)). We will focus here on the two most relevant modes.

  1. The mode in which systemd-resolved is a client of the /etc/resolv.conf. This mode preserves /etc/resolv.conf and is compatible with the procedures described in this page.
  2. The systemd-resolved's recommended mode of operation: the DNS stub file as indicated below contains both the local stub 127.0.0.53 as the only DNS servers and a list of search domains.
/run/systemd/resolve/stub-resolv.conf
nameserver 127.0.0.53
search lan

The service users are advised to redirect the /etc/resolv.conf file to the local stub DNS resolver file /run/systemd/resolve/stub-resolv.conf managed by systemd-resolved. This propagates the systemd managed configuration to all the clients. This can be done by deleting or renaming the existing /etc/resolv.conf and replacing it by a symbolic link to the systemd stub:

# ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf

In this mode, the DNS servers are provided in the resolved.conf(5) file:

/etc/systemd/resolved.conf
[Resolve]
DNS=91.239.100.100 89.233.43.71
...

In order to check the DNS actually used by systemd-resolved, the command to use is:

$ systemd-resolve --status
Tip:
  • To understand the context around the DNS choices and switches, one can turn on detailed debug information for systemd-resolved as described in Systemd#Diagnosing a service.
  • The mode of operation of systemd-resolved is detected automatically, depending on whether /etc/resolv.conf is a symlink to the local stub DNS resolver file or contains server names.

Performance

The #Glibc resolver does not cache queries. If you want local caching use #Systemd-resolved or set up a local caching DNS server and use 127.0.0.1.

Tip: The dig and drill #Lookup utilities report the query time.

Internet service providers usually provide working DNS servers. A router may also add an extra DNS server in case it has its own cache server. Switching between DNS servers is transparent for Windows users, because if a DNS server is slow or does not work it will immediately switch to a better one. However, Linux usually takes longer to timeout, which could cause delays.

Privacy

Most DNS servers keep a log of IP addresses and sites visited on a more or less temporary basis. The data collected can be used to perform various statistical studies. Personally-identifying information have value and can also be rented or sold to third parties. Alternative DNS services provides a list of popular services, check their privacy policy for information about how user data is handled.

Lookup utilities

To query specific DNS servers and DNS/DNSSEC records you can use dedicated DNS lookup utilities. These tools implement DNS themselves and do not use NSS.

For example, to query a specific nameserver with drill for the TXT records of a domain:

$ drill @nameserver TXT domain

If you do not specify a DNS server dig and drill use the nameservers defined in /etc/resolv.conf.

See also