Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Ubuntu - Networking - DNS - Configure DNS ======

<WRAP alert>
**ALERT:**  There are multiple areas where DNS can be set.

It is recommended to only set them in one place, as if set in multiple places then all these DNS resolvers may be used which can result in additional work and confusion when viewing logs.

</WRAP>

----

===== Using Netplan =====

==== Set the DNS ====

<file bash /etc/netplan/01-network-manager-all.yaml>
...
[DEVICE_NAME]:
...
    nameservers:
        addresses: [1.1.1.1, 9.9.9.9]
</file>

<WRAP info>
**NOTE:**  The filename under **/etc/netplan** might be different.
</WRAP>

----

===== Using Global DNS Setting =====

==== Set the DNS ====

<file bash /etc/systemd/resolved.conf>
[Resolve]
DNS=9.9.9.9
FallbackDNS=149.112.112.112
DNSSEC=true
DNSOverTLS=opportunistic
</file>

<WRAP info>
**NOTE:**  This sets both DNSSEC and DNSOverTLS too.

DNSSEC helps prevent a potential attacker from modifying your DNS responses.  systemd-resolved does not enforce this by default.
</WRAP>

----

==== To use multiple resolvers and IPv6 ====

<file bash /etc/systemd/resolved.conf>
[Resolve]
# Use Quad9.net DNS, and Cloudflare DNS.
# Both supports DNS over TLS and DNSSEC,
# and promises not to log DNS queries.
DNS=2620:fe::fe 9.9.9.9 \
    2606:4700:4700::1111 1.1.1.1
FallbackDNS=2620:fe::9 149.112.112.112 \
            2606:4700:4700::1001 1.0.0.1
# Attempt to use DNS over TLS.
DNSOverTLS=opportunistic
# Enforce DNSSEC validation.
DNSSEC=true
</file>

----

===== Restart the systemd-resolved service =====

<code bash>
sudo systemctl restart systemd-resolved.service
</code>

<WRAP info>
**NOTE:**  A restart of the service is needed to allow any DNS changes to take affect.
</WRAP>

----

==== Check the systemd-resolv service is running ====

<code bash>
sudo systemctl status systemd-resolved.service
</code>

returns:

<code bash>
● systemd-resolved.service - Network Name Resolution
     Loaded: loaded (/lib/systemd/system/systemd-resolved.service; enabled; vendor preset: enabled)
     Active: active (running) since Thu 2022-03-17 19:28:19 GMT; 4 days ago
       Docs: man:systemd-resolved.service(8)
             https://www.freedesktop.org/wiki/Software/systemd/resolved
             https://www.freedesktop.org/wiki/Software/systemd/writing-network-configuration-managers
             https://www.freedesktop.org/wiki/Software/systemd/writing-resolver-clients
   Main PID: 1160 (systemd-resolve)
     Status: "Processing requests..."
      Tasks: 1 (limit: 77016)
     Memory: 7.6M
     CGroup: /system.slice/systemd-resolved.service
             └─1160 /lib/systemd/systemd-resolved

Mar 17 19:28:19 bigmamba systemd[1]: Starting Network Name Resolution...
Mar 17 19:28:19 bigmamba systemd-resolved[1160]: Positive Trust Anchors:
Mar 17 19:28:19 bigmamba systemd-resolved[1160]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
Mar 17 19:28:19 bigmamba systemd-resolved[1160]: Negative trust anchors: 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in->
Mar 17 19:28:19 bigmamba systemd-resolved[1160]: Using system hostname 'bigmamba'.
Mar 17 19:28:19 bigmamba systemd[1]: Started Network Name Resolution.
Mar 17 19:30:37 bigmamba systemd-resolved[1160]: Flushed all caches.
Mar 20 10:47:01 bigmamba systemd-resolved[1160]: Flushed all caches.
</code>

----


==== Check status ====

<code bash>
systemd-resolve --status
</code>

returns:

<code bash>
Global
...
         DNS Servers: 9.9.9.9
  DNSOverTLS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
...
Link 4 (br0)
      Current Scopes: DNS
DefaultRoute setting: yes
       LLMNR setting: yes
MulticastDNS setting: no
  DNSOverTLS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
  Current DNS Server: 1.1.1.1
         DNS Servers: 1.1.1.1
          DNS Domain: localdomain
...
</code>

----