I wanted to make sure my server used DNSSEC and DNS-over-TLS, so I went to /etc/systemd/resolved.conf and added the following:
[Resolve] DNS=22.214.171.124 FallbackDNS=126.96.36.199 DNSSEC=true DNSOverTLS=opportunistic
I used Quad9's public DNS servers (188.8.131.52 and 184.108.40.206), which has both DNSSEC and DNSOverTLS. To check that everything was working properly, I restarted systemd (using
systemctl restart systemd-resolved.service) and then ran
systemd-resolve --status. Here are the relevant portions of my output:
Global DNS Servers: 220.127.116.11 Link 3 [DEVICE_NAME] DNSSEC Setting: yes DNSSEC Supported: yes DNS Servers: 18.104.22.168 22.214.171.124
As can be see, the Quad9 DNS appears in Global, but the DNS settings from
/etc/netplan/01-netcfg.yaml still appears under Link 3. The netplan DNS servers are Comodo's which as of this writing do not support either DNS-over-TLS or DNSSEC. So why does systemd-resolved say DNSSEC is supported?
Regardless, a simple solution is to update 01-netcfg.yaml to also use Quad9 DNS servers, but I don't like that, because now there are two places with identical settings and I am not sure which one (or both matter). To understand that, I need to understand how systemd-resolved performs DNS lookups if there is no local cache. Reading the documentation seems to imply that it checks the global DNS and netplan DNS simultaneously. In this case, wouldn't having Quad9 listed as both a global and netplan DNS result in duplicate lookups?
Would it be better to remove the global DNS entirely then by commenting out
FallbackDNS=126.96.36.199 in resolved.conf? Or is it better to remove the DNS declared in 01-netcfg.yaml (I don't know how or if that's possible)?