2

I'm currently testing Ubuntu 20.04.1 (after decades using Fedora from Core 2 to 31), and I have currently issue with local/private DNS resolution.

Getting systematically error messages linked to this vulnerability:

Server returned error NXDOMAIN, mitigating potential DNS violation DVE-2018-0001, retrying transaction with reduced feature level UDP

Simplified context:

  • I have a Synology Router which provides Ethernet network (its @IP address 192.168.56.1)
  • it is the one providing DHCP server
  • each of my devices (about 10) have a specific DHCP registration, with a specific name

For sake of simplification, let's consider the Device named 'nas'.

Out of the box, my Ubuntu 20.04.1 LTS refuses to resolve nas, whatever the used command, see end of this question.

After plenty of readings on Stackoverflow, and Forum, I tried, without success:

  • install libnss-resolve, which enhance /etc/nsswitch.conf file
  • change /etc/resolv.conf symbolic link from /run/systemd/resolve/stub-resolv.conf to /run/systemd/resolve/resolv.conf
  • hack /etc/systemd/resolved.conf file specifying @IP address of my router as DNS server
  • hack /etc/sysctl.conf file to define kernel.domainname with a specific domain, like defined on my Synology Router (previously there was none, and it was working with Fedora)
  • flush the cache sudo systemd-resolve --flush-caches

Tests:

systemd-resolve nas

nas: resolve call failed: No appropriate name servers or networks for name found

dig nas

; <<>> DiG 9.16.1-Ubuntu <<>> nas
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 65082
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;nas.               IN  A

;; Query time: 4 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: mer. juil. 29 15:13:09 CEST 2020
;; MSG SIZE  rcvd: 32

dig @192.168.56.1 nas

; <<>> DiG 9.16.1-Ubuntu <<>> @192.168.56.1 nas
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 34633
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;nas.               IN  A

;; AUTHORITY SECTION:
.           86064   IN  SOA a.root-servers.net. nstld.verisign-grs.com. 2020072900 1800 900 604800 86400

;; Query time: 24 msec
;; SERVER: 192.168.56.1#53(192.168.56.1)
;; WHEN: mer. juil. 29 15:13:30 CEST 2020
;; MSG SIZE  rcvd: 107

nslookup nas

Server: 127.0.0.53 Address: 127.0.0.53#53

** server can't find nas: SERVFAIL

Current contents of my /etc/resolv.conf (the default one):

nameserver 127.0.0.53
options edns0

Current contents of my /etc/nsswitch.conf:

passwd:         files systemd
group:          files systemd
shadow:         files
gshadow:        files

hosts:          files mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

Of course, adding @ip/name mapping in /etc/hosts works but it is NOT a solution.

How can I fix this issue?

Improve this question
12
  • My setup is like yours except 1) I have a search <router supplied default dom> at the end of my (stub) resolv.conf. 2)nslookup,ping, dig name all work for me (this month). Last month, this same setup failed, so is your system fully updated? I also wondered about missing mdns4 in the nsswitch.conf (like the 18.04 has). Local names seem to be a moving target, ;^(
    – ubfan1
    Jul 29, 2020 at 16:20
  • Yes my system is updated to 20.04.1 LTS, and security updates are installed. I tried adding the search <my router @IP> without success :/ What do you mean by missing mdns4 in nsswitch.conf ?
    – Bsquare ℬℬ
    Jul 30, 2020 at 7:33
  • See github.com/datawire/teleproxy/issues/60 The mdns4_minimal only handles .local Wrong about 18.04, it's not there now, Don't recall where I saw it, but the link has an example of using both.
    – ubfan1
    Jul 30, 2020 at 15:52
  • 1
    Thanks, but like I said, without changing anything on my Router, DNS resolution was perfectly working under Fedora ...
    – Bsquare ℬℬ
    Aug 12, 2020 at 20:21
  • 1
    In lieu of fixing dns on the Synology, then you would need a DNS server for local names and dnsmasq is an easy way to provide that service. I run dnsmasq on a small always on computer and hand it out as the first dns ip address for my network. Though I would debug the Synology more as I found indications it can act as a DNS server.
    – Guser314
    Aug 16, 2020 at 19:55

1 Answer 1

Reset to default
1

This error means the DNS server could not resolve the domain. It generally means that your local dns setup sends queries about local domains (.local, .lan, .home, ...) to remode dns servers. In my case, I had configured "Domains=" (with my local search domain) in /etc/systemd/resolved.conf, but no "DNS=" (leaving this to DHCP), which is wrong. When the dns server is provided by dhcp, the search domain has to be provided the same way.

Improve this answer
5
  • So you mean, you fixed your issue, with no more things defined in /etc/systemd/resolved.conf?
    – Bsquare ℬℬ
    Oct 12, 2020 at 8:38
  • Yes, that's right.
    – Olivier
    Oct 13, 2020 at 9:03
  • In my opinion, debugging a dns configuration could be made much easier if there was a --verbose or --debug flag to the systemd-resolve (resolvectl) tool.
    – Olivier
    Oct 13, 2020 at 9:05
  • I tried that, and unfortunately it still doesn't work, I still have systemd-resolved[1273]: Server returned error NXDOMAIN, mitigating potential DNS violation DVE-2018-0001, retrying transaction with reduced feature level UDP.
    – Bsquare ℬℬ
    Nov 26, 2020 at 8:12
  • Some other relevant settings: askubuntu.com/a/1179542/935172
    – Jesse Nickles
    Jan 23, 2021 at 20:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.