1

I wanted to make sure my server used DNSSEC and DNS-over-TLS, so I went to /etc/systemd/resolved.conf and added the following:

[Resolve]
DNS=9.9.9.9
FallbackDNS=149.112.112.112
DNSSEC=true
DNSOverTLS=opportunistic

I used Quad9's public DNS servers (9.9.9.9 and 149.112.112.112), which has both DNSSEC and DNSOverTLS. To check that everything was working properly, I restarted systemd (using systemctl restart systemd-resolved.service) and then ran systemd-resolve --status. Here are the relevant portions of my output:

Global
    DNS Servers: 9.9.9.9

Link 3 [DEVICE_NAME]
      DNSSEC Setting: yes
    DNSSEC Supported: yes
         DNS Servers: 8.26.56.26
                      8.20.247.20

As can be see, the Quad9 DNS appears in Global, but the DNS settings from /etc/netplan/01-netcfg.yaml still appears under Link 3. The netplan DNS servers are Comodo's which as of this writing do not support either DNS-over-TLS or DNSSEC. So why does systemd-resolved say DNSSEC is supported?

Regardless, a simple solution is to update 01-netcfg.yaml to also use Quad9 DNS servers, but I don't like that, because now there are two places with identical settings and I am not sure which one (or both matter). To understand that, I need to understand how systemd-resolved performs DNS lookups if there is no local cache. Reading the documentation seems to imply that it checks the global DNS and netplan DNS simultaneously. In this case, wouldn't having Quad9 listed as both a global and netplan DNS result in duplicate lookups?

Would it be better to remove the global DNS entirely then by commenting out DNS=9.9.9.9 and FallbackDNS=149.112.112.112 in resolved.conf? Or is it better to remove the DNS declared in 01-netcfg.yaml (I don't know how or if that's possible)?

2

I decided to run some experiments to understand systemd behavior. I began by starting sudo tcpdump -i [DEVICE_NAME] port not 22 so I can monitor all network traffic (except my ssh session on port 22). On another ssh terminal, I did an nslookup example.com, using a different website each time so it doesn't utilize its cache. Here are the results under the following settings:

Settings 1 (Different Global and Device DNS Servers)

resolved.conf

DNS=9.9.9.9
FallbackDNS=149.112.112.112

01-netcfg.yaml

[DEVICE_NAME]:
...
    nameservers:
        addresses: [8.26.56.26, 8.20.247.20]

Result:

... [SERVER_NAME] > dns9.quad9.net.domain ... A? [EXAMPLE.COM] (63)
... [SERVER_NAME] > ns1.recursive.dnsbycomodo.com.domain ... A? [EXAMPLE.COM] (63)
... dns9.quad9.net.domain > [SERVER_NAME] ... A [IP_ADDRESS] (56)
... [SERVER_NAME] > dns9.quad9.net.domain ... SOA? [EXAMPLE.COM] (63)
... ns1.recursive.dnsbycomodo.com.domain > [SERVER_NAME] ... A [IP_ADDRESS] (108)
... [SERVER_NAME] >  ns1.recursive.dnsbycomodo.com.domain ... SOA? [EXAMPLE.COM] (63)
...

These were just the first few lines, there were many more requests, but as can be seen, systemd-resolve is requesting records from BOTH the global (Quad9) and device (Comodo) DNS servers. As this is duplicate activity, I commented out the device name servers to see what happens.

Settings 2 (Global and No Device DNS Servers)

resolved.conf

DNS=9.9.9.9
FallbackDNS=149.112.112.112

01-netcfg.yaml

[DEVICE_NAME]:
...
    # nameservers:
        # addresses: [8.26.56.26, 8.20.247.20]

Result:

... [SERVER_NAME] > dns9.quad9.net.domain ... A? [EXAMPLE.COM] (59)
... dns9.quad9.net.domain > [SERVER_NAME] ... A [IP_ADDRESS] (52)
... [SERVER_NAME] > dns9.quad9.net.domain ... SOA? [EXAMPLE.COM] (59)
...

That's much better. It is only requesting from the global DNS server (Quad9) this time, and there is no error. Now, what happens if I set Quad9 as both my global and device DNS server?

Settings 3 (Same Global and Device DNS Servers)

resolved.conf

DNS=9.9.9.9
FallbackDNS=149.112.112.112

01-netcfg.yaml

[DEVICE_NAME]:
...
    nameservers:
        addresses: [9.9.9.9, 149.112.112.112] #changed this

Result:

... [SERVER_NAME] > dns9.quad9.net.domain ... A? [EXAMPLE.COM] (59)
... [SERVER_NAME] > dns9.quad9.net.domain ... A? [EXAMPLE.COM] (59)
... dns9.quad9.net.domain > [SERVER_NAME] ... A [IP_ADDRESS] A [2nd IP_ADDRESS] RRSIG (363)
... [SERVER_NAME] > dns9.quad9.net.domain ... DNSKEY? [EXAMPLE.COM] (59)
... dns9.quad9.net.domain > [SERVER_NAME] ... A [IP_ADDRESS] A [2nd IP_ADDRESS] RRSIG (363)
... [SERVER_NAME] > dns9.quad9.net.domain ... DNSKEY? [EXAMPLE.COM] (59)
... dns9.quad9.net.domain > [SERVER_NAME] ... DNSKEY, DNSKEY, DNSKEY, DNSKEY, RRSIG (1435)
...

It goes on, the first two A? requests were only microseconds apart. Further-down, I usually see two request for each record type, and usually two responses (though sometimes not). This suggests that even if the IP addresses for device and global are the same, it will treats them separately and request the DNS for the records twice. So lesson learned; don't do that.

Based on these results, I am going to remove all DNS declarations in 01-netcfg.yaml, and rely only on the global settings (Settings 2 from the experiments). Hopefully if someone else comes across this, this answer will spare them from having to conduct these experiments.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.