I want to get fast dns resolution with dnsmasq and keep the default systemd-resolved.

Looking for an elegant way to do this

  • 1
    You do realize that systemd-resolved also caches DNS lookups? You don’t need dnsmasq on a system with systemd-resolved. You should read Is systemd-resolved useful?
    – Daniel
    Jan 17, 2019 at 5:41
  • I know - But there is a very significant 'detail'... - dnsmasq as a huge dns cache - The dns cache of systemd-resolved is very smaller and can not be tuned - The dns resolution speed becomes highly improved as the huge cache of dnsmasq has been filled by requests.
    – cmak.fr
    Jan 18, 2019 at 19:25
  • 1
    The default unconfigured cache in systemd-resolved is actual larger than dnsmasq.
    – Daniel
    Jan 19, 2019 at 22:11
  • Actually, dnsmasq does a whole lot more than systemd-resolved; See gist.github.com/jult/4eba88bdd34a57cc79d6#gistcomment-1706666 and gist.github.com/jult/4eba88bdd34a57cc79d6#file-hostsupdater-sh to name but a few..
    – Julius
    Feb 1, 2019 at 16:06
  • 1
    @Aeyoun : by reading systemd-resolved source code, you can see that the dns cache limit of 4096 is bytes, not entries. dnsmasq has a larger -and configurable- dns cache size.
    – cmak.fr
    Feb 2, 2019 at 10:21

5 Answers 5


I wanted to get fast dns resolution with dnsmasq and keep the default systemd-resolved/NetworkManager setup untouched for future use. Yes the huge dns caching of dnsmasq can improve browsing speed. Yes the goal was to keep the default featured dns setup of 18.04

  1. Install dnmasq
  2. Configure it (listen address and dns servers)
  3. Configure NetWorkManager for manual dns server address
  4. Check verify

1 - With sudo

apt-get -y install dnsmasq

2 - With sudo

tee -a /etc/dnsmasq.conf << ENDdm
# DNS server from OpenDns. Use yours...

systemctl restart dnsmasq
systemctl enable dnsmasq

3 - With USER, configure NetworkManager

# Get NM first active profile name
NetManProfile=$(nmcli -t  connection show --active | cut -f 01 -d ':')
# remove, if exists, current dns servers
nmcli con mod "$NetManProfile" ipv4.dns ""
# set 'manual' dns server
nmcli con mod "$NetManProfile" ipv4.ignore-auto-dns yes
# set dnsmasq as manually set dns server
nmcli con mod "$NetManProfile" ipv4.dns
# i also disabled ip6, do what u want
nmcli con mod "$NetManProfile" ipv6.method ignore
# reconnect to take effect
nmcli connection down "$NetManProfile"
nmcli connection up "$NetManProfile"

4 - Check verify

  • systemd-resolved listen on as should by default
  • dnsmasq listen on as set in /etc/dnsmasq
  • systemd-resolved took from NetworkManager
netstat -antup
Proto Recv-Q Send-Q Adresse locale          Adresse distante        Etat       PID/Program name    
tcp        0      0  *               LISTEN      1036/dnsmasq        
tcp        0      0 *               LISTEN      766/systemd-resolve
cat /run/systemd/resolve/resolv.conf 

I have a specific use case that works great. I run dnsmasq on my LAN router (an Ubuntu server machine, with no systemd-resolved), and let the LAN machines behind the router default to vanilla systemd-resolved DNS resolution. It's all possible and works elegantly, with a few tweaks to dnsmasq:

# Make clients that request IPs use this box for DNS


Now I can stand up a gazillion Ubuntu VMs inside my LAN and never have to fiddle with DNS any more - it just works.

The tweaks are required because systemd-resolved does not allow you to use "single-label" host names (with no dot in them), unlike dnsmasq and "classic DNS". Once you get dnsmasq to automatically extend LAN host names into FQDNs, everything is happy. This took me a LONG time to figure out, btw. These systemd-resolved issues 1 2 helped me crack the problem.


I tried to find a reasonable solution and looks that there are different approaches.

I wanted to stay at most within the distribution layout while keeping all business requirements fulfilled. This is what I collected around and tested to work on clean Ubuntu 18.04 and KDE Neon flavour:

# Install required package and reconfigure service plans (i.e. disablesystemd-resolved, enable dnsmasq
sudo apt-get install dnsmasq
sudo systemctl disable systemd-resolved
sudo systemctl stop systemd-resolved
sudo systemctl enable dnsmasq

# These two lines should work on most environments, but .. :-) - so I kept them commented out for less experienced users
# Just add or change 'dns=dnsmasq' to your NetworkManager.conf to the section [main]
# and yes, the sed expression can be better :-)

#sudo cp /etc/NetworkManager/NetworkManager.conf /etc/NetworkManager/NetworkManager.conf.backup
#sudo bash -c 'cat /etc/NetworkManager/NetworkManager.conf.backup |sed -e "s/^dns=.*//"| sed -e "s/\[main\]/\[main\]\ndns=dnsmasq/" >/etc/NetworkManager/NetworkManager.conf'

# Restart NetworkManager to make the change above applied
sudo systemctl restart NetworkManager

# This removes the systemd resolv.conf link only if it has NetworkManager replacement :-)
ls /var/run/NetworkManager/resolv.conf && sudo rm /etc/resolv.conf

# And add NetworkManager's resolv.conf available for the system resolver
sudo ln -s /var/run/NetworkManager/resolv.conf /etc/resolv.conf

(please note that the only general difference with the above answers is that the NetworkManager handle the dnsmasq DNS server assignments automatically

  • works but what happen when networkmanager is upgraded with apt-get --upgrade
    – cmak.fr
    Nov 2, 2018 at 7:08
  • To be honest I do not know. It depends what maintainer of the Ubuntu 18.04 decides. If he/she keeps the systemd-resolved service disabled and will not modify NetworkManager.conf (which is by default resolved interactively in case of conflict), then it could survive until Ubuntu 20.04 where it will be hopefully fixed. Nov 2, 2018 at 8:35

As you know, Docker copy host /etc/resolv.conf file to containers but removing any local nameserver.

My solution to this problem is to keep using systemd-resolvd and NetworkManager but add dnsmasq and use it to "forward" Docker containers DNS queries to systemd-resolvd.

Step by step guide:

  • Make /etc/resolv.conf a "real" file
sudo rm /etc/resolv.conf
sudo touch /etc/resolv.conf
  • Create file /etc/NetworkManager/conf.d/systemd-resolved-for-docker.conf to tell NetworkManager to inform systemd-resolvd but to not touch /etc/resolv.conf
# NetworkManager will push the DNS configuration to systemd-resolved
# NetworkManager won’t ever write anything to /etc/resolv.conf
  • Install dnsmasq
sudo apt-get -y install dnsmasq
  • Configure dnsmasq in /etc/dnsmasq.conf for listening DNS queries comming from Docker and using systemd-resolvd name server
# Use interface docker0
# Explicitly specify the address to listen on
# Looks like docker0 interface is not available when dnsmasq service starts so it fails. This option makes dynamically created interfaces work in the same way as the default.
# Set systemd-resolved DNS server
  • Edit /etc/resolv.conf to use systemd-resolvd nameserver ( and the host IP ( in Docker network
# systemd-resolvd name server
# docker host ip
  • Restart services
sudo service network-manager restart
sudo service dnsmasq restart
sudo service docker restart

For more info see my post (in spanish) https://rubensa.wordpress.com/2020/02/07/docker-no-usa-los-mismos-dns-que-el-host/


Ubuntu 18.10

IMHO, if your going to be running dnsmasq, you should statically assign your ip address instead of getting it from dhcp. This way you can just disable systemd-resolved all together.

  1. sudo apt-get install dnsmasq

  2. sudo systemctl disable systemd-resolved

  3. sudo systemctl stop systemd-resolved

  4. Manually assign your ip address, gateway, and assign the ip address to your machine as DNS.

  5. configure /etc/dnsmasq.conf (really...RTFM --> man dnsmasq.conf)

  6. sudo systemctl enable dnsmasq

  7. reboot
  8. sudo systemctl status dnsmasq

  9. point dhcp on your dhcp server to your shiny new dnsmasq server (..if yumpto)

  • I will not implement what you described. I want the default systemd-resolved remaining untouched for eventual future use of NetworkManager.
    – cmak.fr
    Oct 25, 2018 at 11:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.