Domain name resolution
In general, a domain name represents an IP address and is associated to it in the Domain Name System (DNS). This article explains how to configure domain name resolution and resolve domain names.
Name Service Switch
The Name Service Switch (NSS) facility is part of the GNU C Library (glibc) and backs the getaddrinfo(3) API, used to resolve domain names. NSS allows system databases to be provided by separate services, whose search order can be configured by the administrator in nsswitch.conf(5). The database responsible for domain name resolution is the hosts database, for which glibc offers the following services:
- files: reads the
/etc/hosts
file, see hosts(5) - dns: the glibc resolver which reads
/etc/resolv.conf
, see resolv.conf(5)
systemd provides three NSS services for hostname resolution:
- nss-resolve(8) — a caching DNS stub resolver, described in systemd-resolved
- nss-myhostname(8) — provides local hostname resolution without having to edit
/etc/hosts
- nss-mymachines(8) — provides hostname resolution for the names of local systemd-machined(8) containers
Resolve a domain name using NSS
NSS databases can be queried with getent(1). A domain name can be resolved through NSS using:
$ getent ahosts domain_name
/etc/resolv.conf
and/or /etc/hosts
directly. See Network configuration#localhost is resolved over the network.Glibc resolver
The glibc resolver reads /etc/resolv.conf
for every resolution to determine the nameservers and options to use.
resolv.conf(5) lists nameservers together with some configuration options.
Nameservers listed first are tried first, up to three nameservers may be listed. Lines starting with a number sign (#
) are ignored.
Overwriting of /etc/resolv.conf
Network managers tend to overwrite /etc/resolv.conf
, for specifics see the corresponding section:
- dhcpcd#/etc/resolv.conf
- Netctl#/etc/resolv.conf
- NetworkManager#/etc/resolv.conf
- ConnMan#/etc/resolv.conf
To prevent programs from overwriting /etc/resolv.conf
, it is also possible to write-protect it by setting the immutable file attribute:
# chattr +i /etc/resolv.conf
/etc/resolv.conf
, you can use resolvconf.Alternative using nmcli
If you use NetworkManager, nmcli(1) can be used to set persistent options for /etc/resolv.conf
. Change "Wired" to the name of your connection. Example:
# nmcli con mod Wired +ipv4.dns-options 'rotate,single-request,timeout:1'
For more options have a look at the man pages of nmcli(1), nm-settings-nmcli(5) and resolv.conf(5).
Limit lookup time
If you are confronted with a very long hostname lookup (may it be in pacman or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in /etc/resolv.conf
.
/etc/resolv.conf
options timeout:1
Hostname lookup delayed with IPv6
If you experience a 5 second delay when resolving hostnames it might be due to a DNS-server/Firewall misbehaving and only giving one reply to a parallel A and AAAA request.[1] You can fix that by setting the following option in /etc/resolv.conf
:
/etc/resolv.conf
options single-request
Local domain names
To be able to use the hostname of local machine names without the fully qualified domain name, add a line to /etc/resolv.conf
with the local domain such as:
/etc/resolv.conf
search example.org
That way you can refer to local hosts such as mainmachine1.example.org
as simply mainmachine1
when using the ssh command, but the drill command still requires the fully qualified domain names in order to perform lookups.
Lookup utilities
To query specific DNS servers and DNS/DNSSEC records you can use dedicated DNS lookup utilities. These tools implement DNS themselves and do not use NSS.
ldns provides drill(1), which is a tool designed to retrieve information out of the DNS.
For example, to query a specific nameserver with drill for the TXT records of a domain:
$ drill @nameserver TXT domain
Unless a DNS server is specified, drill will use the nameservers defined in /etc/resolv.conf
.
- knot provides khost(1) and kdig(1).
- Unbound has unbound-host(1).
- BIND has dig(1), host(1), nslookup(1) and a bunch of
dnssec-
tools. - systemd-resolved has resolvectl(1), which provides a
query
sub-command for DNS lookup.
Resolver performance
The Glibc resolver does not cache queries. To implement local caching, use systemd-resolved or set up a local caching DNS server and use it as the name server by setting 127.0.0.1
and ::1
as the name servers in /etc/resolv.conf
or in /etc/resolvconf.conf
if using openresolv.
- The drill or dig lookup utilities report the query time.
- A router usually sets its own caching resolver as the network's DNS server thus providing DNS cache for the whole network.
- If it takes too long to switch to the next DNS server you can try decreasing the timeout.
Privacy and security
The DNS protocol is unencrypted and does not account for confidentiality, integrity or authentication, so if you use an untrusted network or a malicious ISP, your DNS queries can be eavesdropped and the responses manipulated. Furthermore, DNS servers can conduct DNS hijacking.
You need to trust your DNS server to treat your queries confidentially. DNS servers are provided by ISPs and third-parties. Alternatively you can run your own recursive name server, which however takes more effort. If you use a DHCP client in untrusted networks, be sure to set static name servers to avoid using and being subject to arbitrary DNS servers. To secure your communication with a remote DNS server you can use an encrypted protocol, like DNS over TLS (RFC 7858), DNS over HTTPS (RFC 8484), or DNSCrypt, provided that both the upstream server and your resolver support the protocol. An alternative can be a dedicated software to encrypt and decrypt the communication, such as stunnel. To verify that responses are actually from authoritative name servers, you can validate DNSSEC, provided that both the upstream server(s) and your resolver support it.
Although one may use an encrypted DNS resolver, the browser still leaks the domain names in the Server Name Indication when requesting the website certificate. This leak can be checked using the Wireshark filter tls.handshake.extensions_server_name_len > 0
, or using the command line below. A proposed solution is to use the Encrypted Client Hello (ECH), a TLS 1.3 protocol extension.
# tshark -p -Tfields -e tls.handshake.extensions_server_name -Y 'tls.handshake.extensions_server_name_len>0'
Application-level DNS
Be aware that some client software, such as major web browsers[2][3], are starting to implement DNS over HTTPS. While the encryption of queries may often be seen as a bonus, it also means the software sidetracks queries around the system resolver configuration.[4]
Firefox provides configuration options to enable or disable DNS over HTTPS and select a DNS server. Mozilla has setup a Trusted Recursive Resolver (TRR) programme with transparency information on their default providers. It is notable that Firefox supports and automatically enables the Encrypted Client Hello (ECH) for TRR providers, see Firefox/Privacy#Encrypted Client Hello.
Chromium will examine the user's system resolver and enable DNS over HTTPS if the system resolver addresses are known to also provide DNS over HTTPS. See this blog post for more information and how DNS over HTTPS can be disabled.
Mozilla has proposed universally disabling application-level DNS if the system resolver cannot resolve the domain use-application-dns.net
. Currently, this is only implemented in Firefox.
Oblivious DNS
Oblivious DNS (RFC:9230) is a system which addresses a number of DNS privacy concerns. See Cloudflare's article for more information.
Third-party DNS services
There are various third-party DNS services available, some of which also have dedicated software:
- cloudflared — A DNS client for Cloudflare DNS over HTTPS
- opennic-up — Automates the renewal of the DNS servers with the most responsive OpenNIC servers
- nextdns — A DNS-over-HTTPS CLI client for NextDNS
You can use dnsperftest to test the performance of the most popular DNS resolvers from your location. dnsperf.com provides global benchmarks between providers.
DNS servers
DNS servers can be authoritative and recursive. If they are neither, they are called stub resolvers and simply forward all queries to another recursive name server. Stub resolvers are typically used to introduce DNS caching on the local host or network. Note that the same can also be achieved with a fully-fledged name server. This section compares the available DNS servers, for a more detailed comparison, refer to Wikipedia:Comparison of DNS server software.
Name | Package | Capabilities | resolvconf | Supported protocols | |||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Authoritative | Recursive | Cache | Validates DNSSEC |
DNS | DNSCrypt | DNS over TLS |
DNS over HTTPS |
DNS over QUIC | |||
BIND | bind | Yes | Yes | Yes | Yes | Yes | Yes | No | Server1 | Server | No |
CoreDNS | corednsAUR | Yes | No | Yes | No | No | Yes | No | Yes | Yes | No |
DNS-over-HTTPS | dns-over-https | No | No | No | No | ? | ? | No | No | Yes | No |
Deadwood (MaraDNS recursor) | maradnsAUR | No | Yes | Yes | No | No | Yes | No | No | No | No |
dnscrypt-proxy | dnscrypt-proxy | No | No | Yes | No | No | Server | Resolver | No | Yes | ? |
dnsmasq | dnsmasq | Partial2 | No | Yes | Yes | Yes | Yes | No | No | No | No |
dnsproxy | dnsproxyAUR | No | No | Yes | No | No | Yes | Yes | Yes | Yes | Yes |
Knot Resolver | knot-resolver | No | Yes | Yes | Yes | No | Yes | No | Yes | Server | No |
pdnsd | pdnsd | Partial2 | Yes | Permanent | No | Yes | Yes | No | No | No | No |
PowerDNS Recursor | powerdns-recursor | No | Yes | Yes | Yes | Yes | Yes | No | Partial | No | ? |
Rescached | rescached-gitAUR | No | No | Yes | No | Yes | Yes | No | Yes | Yes | No |
RouteDNS | routedns-gitAUR | No | No | Yes3 | No | No | Yes | No | Yes | Yes | Yes |
SmartDNS | smartdns | No | No | Yes | No | ? | Yes | No | Resolver | Resolver | No |
Stubby | stubby | No | No | No | Yes | No | Server | No | Resolver | No | No |
systemd-resolved | systemd | No | No | Yes | Yes | Yes | Resolver and limited server | No | Resolver | No | No |
Unbound | unbound | Partial | Yes | Yes3 | Yes | Yes | Yes | Server | Yes | Server | No |
- BIND can serve both DNS over TLS and DNS over HTTPS (see tls{} and listen-on), but cannot yet forward queries to a DNS over TLS/DNS over HTTPS upstream. The dig tool can make queries over DNS over TLS and DNS over HTTPS (using
+tls
and+https
options), though without any certificate checks. - From Wikipedia: limited authoritative support, intended for internal network use rather than public Internet use.
- Supports persistent cache using the Redis backend.
Authoritative-only servers
Name | Package | DNSSEC | Geographic balancing |
---|---|---|---|
gdnsd | gdnsd | No | Yes |
Knot DNS | knot | Yes | Yes |
MaraDNS | maradnsAUR | No | ? |
NSD | nsd | Yes | No |
PowerDNS | powerdns | Yes | Yes |
Conditional forwarding
It is possible to use specific DNS resolvers when querying specific domain names. This is particularly useful when connecting to a VPN, so that queries to the VPN network are resolved by the VPN's DNS, while queries to the internet will still be resolved by your standard DNS resolver. It can also be used on local networks.
To implement it, you need to use a local resolver because glibc does not support it.
In a dynamic environment (laptops and to some extents desktops), you need to configure your resolver based on the network(s) you are connected to. The best way to do that is to use openresolv because it supports multiple subscribers. Some network managers support it, either through openresolv, or by configuring the resolver directly. NetworkManager supports conditional forwarding without openresolv.
See also
- Linux Network Administrators Guide
- Debian Handbook
- RFC:7706 - Decreasing Access Time to Root Servers by Running One on Loopback
- Domain name system overview - Diagram about DNS
- Alternative DNS services