Skip to content

Instantly share code, notes, and snippets.

  • Star 56 You must be signed in to star a gist
  • Fork 5 You must be signed in to fork a gist
Star You must be signed in to star a gist
Save brasey/fa2277a6d7242cdf4e4b7c720d42b567 to your computer and use it in GitHub Desktop.
Configure systemd-resolved to use a specific DNS nameserver for a given domain

Configure systemd-resolved to use a specific DNS nameserver for a given domain

Use case

Given

  • I use a VPN to connect to my work network
  • I'm on a Linux computer that uses systemd-resolved
  • I have a work domain called example.com
  • example.com is hosted by both public and private DNS nameservers
  • Both public and private nameservers claim to be authoritative for example.com
  • There are no public hosts in example.com
  • The public resolvers for example.com resolve all queries to a parked hosting webpage
  • The private resolvers for example.com contain all correct DNS records for private hosts

I need to

  • Resolve private hosts in example.com when connected to VPN

(Note that this should also work for pointing DNS-blocked domains at different, non-blocked nameservers)

Solution

systemd-resolved now has the ability to specify nameservers for specific domains. Until recently this was not the case, systemd-resolved leaned on NetworkManager, which used dnsmasq for this purpose.

If you were already doing something like this to accomplish this task, first undo all of that. We're not going to use NetworkManager/dnsmasq.

In your systemd-resolved config, which for me is at /etc/systemd/resolved.conf (Fedora), make sure you have this (assuming example.com private nameservers are 10.0.0.1 and 10.0.0.2)

[Resolve]
DNS=10.0.0.1 10.0.0.2
Domains=~example.com

Note the tilde, that makes systemd-resolved do something special. According to the man page:

Specified domain names may optionally be prefixed with "~". In this case they do not define a search path, but preferably direct DNS queries for the indicated domains to the DNS servers configured with the system DNS= setting (see above), in case additional, suitable per-link DNS servers are known.

Restart systemd-resolved and you should be in business.

@george-angel
Copy link

You want a systemd-networkd.service, like this:

[Match]
Name=wg5

[Network]
DNS=10.253.253.253
Domains=~telecomplus.internal ~tp.private

You still need to tie this config to an interface, but interface doesn't need to exist for the service to be "active".

@dreua
Copy link

dreua commented Dec 21, 2021

@george-angel can you elaborate on how to set this up and why it works? What does wg5 stand for? I'm using NetworkManager and a dummy interface in the meantime which seems to work fine for my use case. It is important to me that only the matching requests are sent to that DNS server, when I tried the suggested setup with resolved.conf I could resolve the needed Domains but only because all DNS requests were sent to the specific DNS server. (It happily resolves everything but I don't want to use it for everything.)

@george-angel
Copy link

The way it works with networkd - the specific resolver is tied to an interface, I don't really like it, but thats the way it is.

In my case wg5 is the interface name for the wireguard interface I create that routes my private subnets. I think you can replace that name with your "dummy" reference.

More info here: https://wiki.archlinux.org/title/systemd-networkd

@leiless
Copy link

leiless commented Dec 30, 2022

sudo resolvectl dns eth0 8.8.8.8 8.8.4.4
resolvectl dns eth0

@JackThird
Copy link

thanks, you save my day ;)

@BastienFaure
Copy link

I am really surprised it works that way, is that intentional ? You explicitly specify a DNS server and instruct systemd-resolved to use that server for a certain domain only. The output of resolvectl does not even displays DefaultRoute so I am really trying to understand why would the DNS server receive all queries

@george-angel
Copy link

I think because DNS in [Resolve] is global config. Even if you specify some Domains there, what is it supposed to use for everything else?

The config its related to: https://wiki.archlinux.org/title/Systemd-networkd#[Network] - which makes sense there, but makes it less obvious when used in global context, like in /etc/systemd/resolved.conf .

It makes more sense if any of your "per link" config has Domains=~., in which case the more specific Domains config in /etc/systemd/resolved.conf would work as intended.

@bio-informatician
Copy link

Well
sudo resolvectl dns ens3 8.8.8.8 8.8.4.4
solved the issue, but after restart dns list disappears again.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment