systemd-resolved

← Back to systemd

systemd-resolved is a systemd service that provides network name resolution to local applications via a D-Bus interface, the resolve NSS service (nss-resolve(8)), and a local DNS stub listener on 127.0.0.53. See systemd-resolved(8) for the usage.

Configuration Example: Enforce secure DNS

The following configuration configures resolved daemon to use the public DNS resolver provided by Cloudflare. DNSSEC and DNS-over-TLS is enabled for authenticity and encryption.

Warning: This secure DNS will break most captive portals like those of public or hotel wifi access points, resulting in inability to gain internet access through such access points.

In that case, use networkctl status ${wlan interface} to show the default DNS provided by the network, and temporarily change nameserver inside /etc/resolv.conf from 127.0.0.53 to the provided one.

Alternatively, if you have Chromium installed, you can use the pkgs.captive-browser Chromium wrapper, which is "Dedicated Chrome instance to log into captive portals without messing with DNS settings".

networking.nameservers = [
  "1.1.1.1"
  "1.0.0.1"
];

services.resolved = {
  enable = true;
  dnssec = "true";
  domains = [ "~." ];
  fallbackDns = [
    "1.1.1.1"
    "1.0.0.1"
  ];
  dnsovertls = "true";
};