Prioritizing DNS Servers

[rkillcrazy]

Poking around the web this morning got me to the point of tweaking the DNS servers via systemd-resolve. However, while I was able to add the DNS entries, I wasn't able to prioritize them. I figured I could do so just by adding them in a certain order...

Code: Select all

sudo systemd-resolve --interface enp3s0 --set-dns 192.168.100.13 --set-dns 192.168.20.103 --set-dns 9.9.9.9 --set-dns 1.1.1.1

The command went through just fine and I was actually using the first server in the list for a few minutes but then it changed to third one on the list and I'm unsure how that happened...

Code: Select all

systemd-resolve --status enp3s0
Link 2 (enp3s0)
      Current Scopes: DNS           
DefaultRoute setting: yes           
       LLMNR setting: yes           
MulticastDNS setting: no            
  DNSOverTLS setting: no            
      DNSSEC setting: no            
    DNSSEC supported: no            
  Current DNS Server: 9.9.9.9       
         DNS Servers: 192.168.100.13
                      192.168.20.103
                      9.9.9.9       
                      1.1.1.1       
          DNS Domain: ~.            
                      localdomain

How can I prioritize the list? Why would the Current DNS Server change - seemingly - on its own?

[antikythera]

It is set up to use the fastest responding server even if you try setting the order rigidly. Otherwise you will end up with very slow page resolution as it pings all the DNS servers in order until it gets a response to your request to load a page. The first two aren't responding to pings for me so maybe your machine has worked out that too for itself.

[t42]

Probably your /etc/resolv.conf is a symlink to /run/systemd/resolve/resolv.conf

Code: Select all

file /etc/resolv.conf

According to systemd-resolved.service

The DNS servers contacted are determined from the global settings in /etc/systemd/resolved.conf, the per-link static settings in /etc/systemd/network/*.network files (in case systemd-networkd.service(8) is used), the per-link dynamic settings received over DHCP, information provided via resolvectl(1), and any DNS server information made available by other system services. See resolved.conf(5) and systemd.network(5) for details about systemd's own configuration files for DNS servers. To improve compatibility, /etc/resolv.conf is read in order to discover configured system DNS servers, but only if it is not a symlink to /run/systemd/resolve/stub-resolv.conf, /usr/lib/systemd/resolv.conf or /run/systemd/resolve/resolv.conf.

[rkillcrazy]

The first two aren't responding to pings for me so maybe your machine has worked out that too for itself.

The first two are local to my network. Unless you have something on your network using those same IPs and responding to ICMP, you'll never get a response from them.

[antikythera]

yeah, should have realised that from the IP addresses. Anyhow, the same logic applies still. If your system doesn't get a decent response from those IP addresses it will use the next that does work okay.

[rkillcrazy]

yeah, should have realised that from the IP addresses. Anyhow, the same logic applies still. If your system doesn't get a decent response from those IP addresses it will use the next that does work okay.

I get it but, based on my limited testing, I don't see how an external address can respond faster than a local one in most cases.

Code: Select all

ping 1.1.1.1
PING 1.1.1.1 (1.1.1.1) 56(84) bytes of data.
64 bytes from 1.1.1.1: icmp_seq=1 ttl=57 time=43.1 ms
64 bytes from 1.1.1.1: icmp_seq=2 ttl=57 time=43.2 ms

ping 9.9.9.9
PING 9.9.9.9 (9.9.9.9) 56(84) bytes of data.
64 bytes from 9.9.9.9: icmp_seq=1 ttl=57 time=41.3 ms
64 bytes from 9.9.9.9: icmp_seq=2 ttl=57 time=40.9 ms

ping 192.168.20.103
PING 192.168.20.103 (192.168.20.103) 56(84) bytes of data.
64 bytes from 192.168.20.103: icmp_seq=1 ttl=64 time=0.390 ms
64 bytes from 192.168.20.103: icmp_seq=2 ttl=64 time=0.310 ms

ping 192.168.100.13
PING 192.168.100.13 (192.168.100.13) 56(84) bytes of data.
64 bytes from 192.168.100.13: icmp_seq=1 ttl=63 time=1.10 ms
64 bytes from 192.168.100.13: icmp_seq=2 ttl=63 time=0.973 ms

[rkillcrazy]

Probably your /etc/resolv.conf is a symlink to /run/systemd/resolve/resolv.conf

Code: Select all

file /etc/resolv.conf

According to systemd-resolved.service

The DNS servers contacted are determined from the global settings in /etc/systemd/resolved.conf, the per-link static settings in /etc/systemd/network/*.network files (in case systemd-networkd.service(8) is used), the per-link dynamic settings received over DHCP, information provided via resolvectl(1), and any DNS server information made available by other system services. See resolved.conf(5) and systemd.network(5) for details about systemd's own configuration files for DNS servers. To improve compatibility, /etc/resolv.conf is read in order to discover configured system DNS servers, but only if it is not a symlink to /run/systemd/resolve/stub-resolv.conf, /usr/lib/systemd/resolv.conf or /run/systemd/resolve/resolv.conf.

I ran the command. I may be a little foggy/slow from the sickness but I'm not fully understanding what I'm looking for in the excerpt you highlighted.

Code: Select all

file /etc/resolv.conf
/etc/resolv.conf: symbolic link to ../run/resolvconf/resolv.conf

[rkillcrazy]

According to systemd-resolved.service

To improve compatibility, /etc/resolv.conf is read in order to discover configured system DNS servers, but only if it is not a symlink to /run/systemd/resolve/stub-resolv.conf, /usr/lib/systemd/resolv.conf or /run/systemd/resolve/resolv.conf.

Wait...I think I'm getting something.... So, my /etc/resolv.conf is a symlink so that's why it can't/won't be read directly. Therefore, I cannot bypass the way the system uses the configured DNS servers....

So, could I just delete the symlink? What could possibly go wrong!?

[t42]

could I just delete the symlink? What could possibly go wrong!?

You can try to replace the symlink with ASCII text such as /run/resolvconf/resolv.conf and edit it accordingly.
Be warned - resolved resolver is a complicated mess. I stopped using it long ago.

[rkillcrazy]

You can try to replace the symlink with ASCII text such as /run/resolvconf/resolv.conf and edit it accordingly.
Be warned - resolved resolver is a complicated mess. I stopped using it long ago.

If you've stopped using this method, is there a better way of going about what I'm looking to do?

[t42]

I'm using DOT with stubby + dnsmasq from each PC directly, trying to exclude router. Something like Setting up DNS over TLS . It may be not how you want to configure your internal network. Stubby can be set up in the round robin mode or prioritize the first server in the stubby config.

[rkillcrazy]

I'm using DOT with stubby + dnsmasq from each PC directly, trying to exclude router. Something like Setting up DNS over TLS . It may be not how you want to configure your internal network. Stubby can be set up in the round robin mode or prioritize the first server in the stubby config.

Interesting... Well, if I decide to go that route, how do I revert the changes I've made? If I run something like the following, does the system revert back to the settings where it used the DNS servers provided by DHCP?

Code: Select all

sudo systemd-resolve --interface enp3s0 --revert

[t42]

Code: Select all

sudo systemd-resolve --interface enp3s0 --revert

I'm not sure, there is Network Manager participation too. For me it's easy to revert settings described. Also you can create another profile in the network manager and switch several resolvers with a click of a button.