Systemd/resolved - Revision history

Jackrosenberg: /* Configuration Example: Enforce secure DNS */ update to the new settings.Resolved format.

2026-04-22T09:13:48Z

Configuration Example: Enforce secure DNS: update to the new settings.Resolved format.

← Older revision		Revision as of 09:13, 22 April 2026
Line 26:		Line 26:
	services.resolved = {		services.resolved = {
	enable = true;		enable = true;
	~~dnssec~~ = "true";		settings.Resolve = {
	~~domains~~ = [ "~." ];		DNSSEC = "true";
	~~fallbackDns~~ = [		Domains = [ "~." ];
	"1.1.1.1"		DNSOverTLS = "true";
	"1.0.0.1"		FallbackDNS = [
	];		"1.1.1.1"
	~~dnsovertls = "true"~~;		"1.0.0.1"
			];
			};
	};		};
	</syntaxhighlight>		</syntaxhighlight>

Tie-ling: add link Encrypted DNS

2025-09-21T21:35:51Z

add link Encrypted DNS

← Older revision		Revision as of 21:35, 21 September 2025
Line 12:		Line 12:

	= Configuration Example: Enforce secure DNS =		= Configuration Example: Enforce secure DNS =

			See also [[Encrypted DNS]].

	The following configuration configures resolved daemon to use the public DNS resolver provided by [https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/ Cloudflare]. DNSSEC and DNS-over-TLS is enabled for authenticity and encryption.		The following configuration configures resolved daemon to use the public DNS resolver provided by [https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/ Cloudflare]. DNSSEC and DNS-over-TLS is enabled for authenticity and encryption.

Tie-ling: use nixos config module

2025-09-21T21:11:57Z

use nixos config module

← Older revision		Revision as of 21:11, 21 September 2025
Line 8:		Line 8:
	In that case, use <code>networkctl status ${wlan interface}</code> to show the default DNS provided by the network, and temporarily change nameserver inside <code>/etc/resolv.conf</code> from <code>127.0.0.53</code> to the provided one.		In that case, use <code>networkctl status ${wlan interface}</code> to show the default DNS provided by the network, and temporarily change nameserver inside <code>/etc/resolv.conf</code> from <code>127.0.0.53</code> to the provided one.

	Alternatively, if you have Chromium installed, you can use the <code>~~pkgs~~.captive-browser</code> Chromium wrapper, which is "Dedicated Chrome instance to log into captive portals without messing with DNS settings".		Alternatively, if you have Chromium installed, you can use the <code>programs.captive-browser.enable</code> Chromium wrapper, which is "Dedicated Chrome instance to log into captive portals without messing with DNS settings".

Tie-ling: add section for workarounds

2025-09-21T21:06:37Z

add section for workarounds

← Older revision		Revision as of 21:06, 21 September 2025
Line 3:		Line 3:
	[https://www.freedesktop.org/software/systemd/man/systemd-resolved.html systemd-resolved] is a [[systemd]] service that provides network name resolution to local applications via a D-Bus interface, the resolve NSS service (nss-resolve(8)), and a local DNS stub listener on 127.0.0.53. See systemd-resolved(8) for the usage.		[https://www.freedesktop.org/software/systemd/man/systemd-resolved.html systemd-resolved] is a [[systemd]] service that provides network name resolution to local applications via a D-Bus interface, the resolve NSS service (nss-resolve(8)), and a local DNS stub listener on 127.0.0.53. See systemd-resolved(8) for the usage.

	== ~~Configuration Example: Enforce secure~~ DNS ==		= Secure DNS and Captive Portal =
			Secure DNS will break most captive portals like those of public or hotel wifi access points, resulting in inability to gain internet access through such access points.

			In that case, use <code>networkctl status ${wlan interface}</code> to show the default DNS provided by the network, and temporarily change nameserver inside <code>/etc/resolv.conf</code> from <code>127.0.0.53</code> to the provided one.

			Alternatively, if you have Chromium installed, you can use the <code>pkgs.captive-browser</code> Chromium wrapper, which is "Dedicated Chrome instance to log into captive portals without messing with DNS settings".

	The following configuration configures resolved daemon to use the public DNS resolver provided by [https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/ Cloudflare]. DNSSEC and DNS-over-TLS is enabled for authenticity and encryption.

	~~Warning~~: ~~This~~ secure DNS ~~will break most captive portals like those of public or hotel wifi access points, resulting in inability to gain internet access through such access points.~~		= Configuration Example: Enforce secure DNS =

	~~In that case,~~ use ~~<code>networkctl status ${wlan interface}</code> to show~~ the ~~default~~ DNS provided by ~~the network, and temporarily change nameserver inside <code>~~/~~etc~~/~~resolv~~.~~conf<~~/~~code> from <code>127~~.0.0.~~53<~~/~~code> to the provided one~~.		The following configuration configures resolved daemon to use the public DNS resolver provided by [https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/ Cloudflare]. DNSSEC and DNS-over-TLS is enabled for authenticity and encryption.

	Alternatively, if you have Chromium installed, you can use the <code>pkgs.captive-browser</code> Chromium wrapper, which is "Dedicated Chrome instance to log into captive portals without messing with DNS settings".

	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">

Tie-ling: add captive portal browser

2025-09-21T21:03:31Z

add captive portal browser

← Older revision		Revision as of 21:03, 21 September 2025
Line 10:		Line 10:

	In that case, use <code>networkctl status ${wlan interface}</code> to show the default DNS provided by the network, and temporarily change nameserver inside <code>/etc/resolv.conf</code> from <code>127.0.0.53</code> to the provided one.		In that case, use <code>networkctl status ${wlan interface}</code> to show the default DNS provided by the network, and temporarily change nameserver inside <code>/etc/resolv.conf</code> from <code>127.0.0.53</code> to the provided one.

			Alternatively, if you have Chromium installed, you can use the <code>pkgs.captive-browser</code> Chromium wrapper, which is "Dedicated Chrome instance to log into captive portals without messing with DNS settings".

	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">

Tie-ling: workaround for resolved

2025-09-21T21:00:12Z

workaround for resolved

← Older revision		Revision as of 21:00, 21 September 2025
Line 7:		Line 7:
	The following configuration configures resolved daemon to use the public DNS resolver provided by [https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/ Cloudflare]. DNSSEC and DNS-over-TLS is enabled for authenticity and encryption.		The following configuration configures resolved daemon to use the public DNS resolver provided by [https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/ Cloudflare]. DNSSEC and DNS-over-TLS is enabled for authenticity and encryption.

	Warning: This ~~config snippet~~ will break most captive portals like those of public or hotel wifi access points, resulting in inability to gain internet access through such access points.		Warning: This secure DNS will break most captive portals like those of public or hotel wifi access points, resulting in inability to gain internet access through such access points.

			In that case, use <code>networkctl status ${wlan interface}</code> to show the default DNS provided by the network, and temporarily change nameserver inside <code>/etc/resolv.conf</code> from <code>127.0.0.53</code> to the provided one.

	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">

DavHau: Mention that the given example config breaks captive portals

2025-09-21T05:49:12Z

Mention that the given example config breaks captive portals

← Older revision		Revision as of 05:49, 21 September 2025
Line 3:		Line 3:
	[https://www.freedesktop.org/software/systemd/man/systemd-resolved.html systemd-resolved] is a [[systemd]] service that provides network name resolution to local applications via a D-Bus interface, the resolve NSS service (nss-resolve(8)), and a local DNS stub listener on 127.0.0.53. See systemd-resolved(8) for the usage.		[https://www.freedesktop.org/software/systemd/man/systemd-resolved.html systemd-resolved] is a [[systemd]] service that provides network name resolution to local applications via a D-Bus interface, the resolve NSS service (nss-resolve(8)), and a local DNS stub listener on 127.0.0.53. See systemd-resolved(8) for the usage.

	== Configuration ==		== Configuration Example: Enforce secure DNS ==

	The following configuration configures resolved daemon to use the public DNS resolver provided by [https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/ Cloudflare]. DNSSEC and DNS-over-TLS is enabled for authenticity and encryption.		The following configuration configures resolved daemon to use the public DNS resolver provided by [https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/ Cloudflare]. DNSSEC and DNS-over-TLS is enabled for authenticity and encryption.

			Warning: This config snippet will break most captive portals like those of public or hotel wifi access points, resulting in inability to gain internet access through such access points.

	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">

Klinger: Category:DNS added

2025-03-20T16:29:50Z

Category:DNS added

← Older revision		Revision as of 16:29, 20 March 2025
Line 26:		Line 26:
	[[Category:systemd]]		[[Category:systemd]]
	[[Category:Networking]]		[[Category:Networking]]
			[[Category:DNS]]

Onny at 18:53, 14 May 2024

2024-05-14T18:53:44Z

← Older revision		Revision as of 18:53, 14 May 2024
Line 8:		Line 8:

	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
			networking.nameservers = [
			"1.1.1.1"
			"1.0.0.1"
			];

	services.resolved = {		services.resolved = {
	enable = true;		enable = true;

Onny: /* Configuration */ Cleanup

2024-05-13T12:30:50Z

Configuration: Cleanup

← Older revision		Revision as of 12:30, 13 May 2024
Line 7:		Line 7:
	The following configuration configures resolved daemon to use the public DNS resolver provided by [https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/ Cloudflare]. DNSSEC and DNS-over-TLS is enabled for authenticity and encryption.		The following configuration configures resolved daemon to use the public DNS resolver provided by [https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/ Cloudflare]. DNSSEC and DNS-over-TLS is enabled for authenticity and encryption.

	<~~syntaxHighlight~~ lang="nix">		<syntaxhighlight lang="nix">
	~~networking.nameservers = [~~
	~~"1.1.1.1#one.one.one.one"~~
	~~"1.0.0.1#one.one.one.one"~~
	];

	services.resolved = {		services.resolved = {
	enable = true;		enable = true;
Line 18:		Line 13:
	domains = [ "~." ];		domains = [ "~." ];
	fallbackDns = [		fallbackDns = [
	"1.1.1.1~~#one.one.one.one~~"		"1.1.1.1"
	"1.0.0.1~~#one.one.one.one~~"		"1.0.0.1"
	];		];
	dnsovertls = "true";		dnsovertls = "true";
	};		};
	</~~syntaxHighlight~~>		</syntaxhighlight>
	[[Category:systemd]]		[[Category:systemd]]
	[[Category:Networking]]		[[Category:Networking]]