I recently tried to enable system-wide DNS over https on Fedora. To do so I had to to some research and found out how comfusing it is for the average user (and even experienced users) to change the settings. In fact there are multiple backends messing with system DNS at the same time.
Most major Linux distributions use systemd-resolved for DNS but there is no utility for changing its configuration.
The average user would still try to change DNS settings by editing /etc/relov.conf (which is overwritten and will not survive reboots) or changing settings in Network Manager.
Based on documentation of systemd-resolved, the standard way of adding custom DNS servers is putting so-called ‘drop-in’ files in /etc/systemd/resolved.conf.d directory, especially when you want to use DNS-over-TLS or DNS-over-https.
Modern browsers use their buit-in DNS settings which adds to the confusion.
I think this is one area that Linux needs more work and more standardization.
How do you think it should be fixed?
The average user would still try to change DNS settings by editing /etc/relov.conf (which is overwritten and will not survive reboots) or changing settings in Network Manager.
No. The average user would use NetworkManager GUI integrated into DE.
Network Manager doesn’t support DOH.
The average user barely know what is DNS, so DoH…
Removed by mod
changing settings in Network Manager.
What’s wrong with this method? I feel like this is the main one and it works well for me. Even if you were using systemd-resolved, I believe it still works.
This is the answer for desktop Linux. Have NM create the drop in for systemd-resolved when the settings are changed. This is NM’s job.
Do any modern OS’s set DNS system wide?
I don’t disagree there should be an option because I see maybe why they wouldn’t do that.
All of them?
Oh never mind. I’m thinking per adapter, not per connection. You’re right.
Yeah, it’s pretty easy on macos using configuration profiles
I typically leave my DNS config to my router and PiHole. I run a VPN server to my home network so I have the same setup no matter where I am. I’ll agree, it used to be that /etc/resolv.conf was the go to, but systemd had been interesting to say the least.
I also found this if it helps you any.
Problems:
- you need an additional solution for Wifi captives portals, at least there is a gap in your solution for this situation
- intercontinental travelling might not be fun
Iirc, Unifi gear does captive portals, but good points all around.
Slightly off topic, but as long as we’re ranting about DNS…
Proxmox handles DNS for each container as a setting in the hypervisor. It’s not a bad way of simplifying things, but if, hypothetically, you didn’t know about that, then you could find yourself in a situation where you spend an entire afternoon trying every single one of the million different ways to edit DNS in Linux and getting increasingly frustrated because the IP gets overwritten every time you restart the container no matter what you do, until eventually you figure out that the solution is just like three clicks and a text entry box in the Proxmox GUI!
…Hypothetically, of course.
Wait, what? LOL didn’t know Proxmox had that!
Thanks, you’ve saved me from spending some afternoons. I don’t want to think about how much time I spent on DNS before this
I don’t touch my fedora DNS settings because my openwrt router handles DoT for the entire network.
That doesn’t help outside of home. When we are in an untrusted network then the DNS mess makes us vulnerable for spoofing attacks.
Wireguard to home or a vps running a pihole. Block all dns other than over wireguard.
Doesn’t this solution mess with captive portals?
Ive never had an issue. You could always just disable it to load the captive portal then turn it back on after you’re connected.
- Wireguard
- I run my own DoT/DoH server and able to connect it from everywhere. This makes option 1 mostly obsolete.
PS. And yes, I fucking love to solve captchas. No, I am not a Robot.
Could also look at tailscale, set it up on you home PCs and mobile devices, set the magic DNS to a home server or vps running pihole. If you don’t like the aspect of tailscale being controlled by a third party you could self host that part using headscale on docker as well
deleted by creator
DoT and DoH are really the most important when you’re not at home.
deleted by creator
My two cents: Yes, it’s bad. The biggest hurdle to people not “intimately familiar” with their distro is A) what it’s using for DNS configuration and B) realizing that there are so many different ways in different distributions, and sometimes within one distribution, that you have to be very careful what googled results you follow. That many browsers do their own thing doesn’t help. I think the best way to solve it would be some desktop level abstraction like PackageKit where it doesn’t really matter what services does the resolving under the hood.
Xkcd “standards”
Totally agree. There should be only one place for setting the system-wide DNS.
Most major Linux distributions use systemd-resolved for DNS but there is no utility for changing its configuration.
Nor should there be. That’s what the configuration files are for, and the utility to edit them is the editor of your choice.
I don’t think systemd-resolved has support for DNS-over-HTTPS yet but it has support for DNS over TLS which I have used issue free for years now.
All the browsers will use your system configured DNS if you do not touch the browser’s DNS settings.
DNS is not broken on Linux, your configuration is.
All the browsers will use your system configured DNS if you do not touch the browser’s DNS settings.
Not necessarily. Firefox ships with its own DoH enabled out of the box, which uses Cloudflare servers.
Then Firefox is broken in this context. It should respect the user’s system DNS settings.
Edit: You are wrong. The correct answer is somewhere along the lines of borderline confusing and you don’t have to worry about it if everything is working. In my case, it used my DNS provider set by systemd-resolved and not cloudflare but YMMV.
This is what the default menu for Firefox DNS settings say:
Enable secure DNS using: ... Firefox decides when to use secure DNS to protect your privacy. Use secure DNS in regions where it’s available Use your default DNS resolver if there is a problem with the secure DNS provider Use a local provider, if possible .... Turn off when VPN, parental control, or enterprise policies are active Turn off when a network tells Firefox it shouldn’t use secure DNSFirefox DoH has been enabled by default for the US for a couple of years now.
The US is not the world!
And neither Firefox nor its broken? DNS implementation have anything to do with the topic(Linux DNS)…
You said all browsers would follow your system DNS, I just explained that’s not always the case.
And there is actually a common problem with devices on the LAN that use DoH. You can block their access to the specific DNS servers they use, or block their access to the internet altogether, but you can’t force them to use your DNS settings.
You said all browsers would follow your system DNS, I just explained that’s not always the case.
Both Firefox & Chrome follow my system DNS at default settings. Just because Firefox forcefully enrolled US users to Cloudflare’s DOH doesn’t mean that DNS is broken for every one else.
And there is actually a common problem with devices on the LAN that use DoH. You can block their access to the specific DNS servers they use, or block their access to the internet altogether, but you can’t force them to use your DNS settings.
Again. Has nothing to do with the topic i.e Linux DNS. Applications can use their own custom DOH/DOQ resolvers to bypass system DNS, this has no bearing on the brokeness or not of systemd-resolved or any other system DNS resolver.
Your suggested solution would leak DNS for everything except thr browser. That’s a broken implementation
Your suggested solution would leak DNS for everything except thr browser
How so?
Modern browsers use their buit-in DNS settings which adds to the confusion.
There’s no way of stopping any application sending DNS queries on its own unless you really want to lock down everything with a heavy hand (firewall, container, apparmor / selinux). As long as there’s a toggle to turn it off, I’m okay with that.
How do you think it should be fixed?
The Tailscale folks speak of systemd-resolved positively and it works well for my own use case.
Right now I use both systemd-resolved & systemd-networkd on my laptop with a dnsproxy service to query outside DNS servers with DNS-over-HTTPS. systemd-resolved is responsible for handling queries from applications, caching and per-domain DNS routing (
~home.arpafor virtual machines and~lanfor machines in my home network).There is one little caveat: when I have to connect to a free Wi-Fi which requires authorizing via a captive portal implemented by traffic hijacking, I’ll have to enable
DNSDefaultRoute=in the Wi-Fi network config file, tell systemd-networkd to reload, finish the authorization in a browser page, revert the previous change, reload systemd-networkd again. It’s a lot of steps but I can automate most of them with a script for now.Long term wise, hopefully systemd-resolved will support DNS-over-HTTPS (and DNS-over-QUIC) then I can stop running dnsproxy.
Edit: link to some blog post
It’s very easy when not using systemd-resolved.
In defense of systemd-resolved, it’s meant for static configurations. I absolutely love it for my stationary machines for its simplicity and tooling. However, for machines that might need to change settings at one point - say notebooks - I’d never consider it. Same for systemd-networkd.
I just edit
resolv.confdirectly, and then dochattr +i /etc/resolv.confto make it persistentSystemd likes to ruin all the easy stuff with overcomplicated bloated programms.
No software should EVER touch any DNS related configuration or file and no application should bring it’s own system for DNS request. Everything regarding DNS without any exception should be done by the application that sets up and handle the network connection.
No software should EVER touch any DNS related configuration
Uhh good luck with that. If it were stored on magnetic media I’d suggest “a magnet and a very steady hand” but that doesn’t work so much for SSDs.
This isn’t really a “Linux” problem. Calling it a Linux problem implies all distros do the same thing out of the box because it’s a part of the core system. Systemd has a file,
/etc/systemd/resolved.confwhich has one lineDNS=that you can add the servers you want. It’s as simple as that. If you’re using Dnsmasq for DNS instead, you’d edit the Dnsmasq file. If you’re not using my of those (i.e. you removed systemd-resolved, Dnsmasq, etc) then you can just edit the/etc/reeolv.confdirectly without worry of it being overwritten.While many distros come with systemd out of the box, not all of them do. For example, I use Gentoo with rc and after editing my resolv.conf, never had to worry about it again unless I decided to install a custom DNS software on it later.
I read many replies to your post as “DNS software shouldn’t be allowed to change DNS settings” for the most part, and that doesn’t quite make sense to me. If it’s a problem, remove said software. Browsers are definitely annoying in the DNS front, I won’t disagree with that. Fortunately, they allow you to turn that off though.
Very much agreed 👍 I realized when using the dnscrypt to set the DNS settings. There is resolv.conf which used to be the final authority regarding your DNS. Now I don’t know anymore
it still is, just make it read only.
not reliable, even if it should be. i’ve seen updates replace the file in a way that clears the read-only flag. same with other clever tricks like making it a symlink.
chattr +i
;)
No problems here using /etc/systemd/resolved.conf for NextDNS settings. I also set the dns settings for NextDNS in Firefox.
