Which upstream nameservers do dnsmasq/NetworkManager use really?

Question

I'm trying to do some troubleshooting and installing dnscrypt(-proxy) on my Laptop. I want to find out which DNS servers effectively are used by my standard Ubuntu installation (w/ NetworkManager and dnsmasq, of course). However I found the configuration of dnsmasq a maze. I couldn't find out which DNS servers it's set to query.

First, I checked /etc/resolv.conf, which, of course, is set up to query 127.0.1.1 where dnsmasq-base is listening. Ok, so time to check dnsmasq config for which servers it's set up to query. /etc/dnsmasq.d/ is empty, though, except for network-manager with a single entry: bind-interfaces. Not much help there. So I check how NetworkManager calls dnsmasq:

$ pgrep -a dnsmasq
1786 /usr/sbin/dnsmasq --no-resolv --keep-in-foreground --no-hosts --bind-interfaces --pid-file=/var/run/NetworkManager/dnsmasq.pid --listen-address=127.0.1.1 --cache-size=0 --conf-file=/dev/null --proxy-dnssec --enable-dbus=org.freedesktop.NetworkManager.dnsmasq --conf-dir=/etc/NetworkManager/dnsmasq.d

Ok so it's not using /etc/resolv.conf, it's ignoring /etc/hosts/, it's config file is set to /dev/null and /etc/NetworkManager/dnsmasq.d is empty, too. So no clues there, either. Must fall back to some defaults or something?

Other files I found:

• /run/NetworkManager/resolv.conf says nameserver 127.0.1.1
• /run/resolvconf/resolv.conf says nameserver 127.0.1.1
• /etc/resolv.conf says nameserver 127.0.1.1
• /etc/resolvconf/base is empty, ./head only has comments
• /var/ and /run/ have no further files named resolv.conf

Running wireshark, I can see that it's asking my home router for DNS answers (as expected). But where does it get that IP and where do I change it, without using all the other functionality of dnsmasq and NetworkManager (e.g. split DNS for VPN)?

Answer 1

Found out where that information, after is has ben received via DHCP, is kept:

/var/lib/NetworkManager/*lease

For changing those settings, refer to NetworkManager's documentation:

nmcli con modify my-office my-office ipv4.ignore-auto-dns yes ipv6.ignore-auto-dns yes
nmcli con mod test-lab ipv4.dns "8.8.8.8 8.8.4.4"
nmcli con mod test-lab ipv6.dns "2001:4860:4860::8888 2001:4860:4860::8844"

Answer 2

This answer was tested on Ubuntu 16.04 only. Other versions may differ in how they do DNS resolution.

As you figured out, dnsmasq as managed by NetworkManager does not read any DNS servers from the filesystem. The secret is this flag:

--enable-dbus=org.freedesktop.NetworkManager.dnsmasq

So NetworkManager uses dbus to configure dnsmasq dynamically at runtime. Its dbus interface looks like this:

$ sudo dbus-send --system --type=method_call --print-reply \
    --dest=org.freedesktop.NetworkManager.dnsmasq \
    /uk/org/thekelleys/dnsmasq \
    org.freedesktop.DBus.Introspectable.Introspect
method return time=1613637106.507949 sender=:1.16 -> destination=:1.49 serial=11 reply_serial=2
   string "<!DOCTYPE node PUBLIC "-//freedesktop//DTD D-BUS Object Introspection 1.0//EN"
"http://www.freedesktop.org/standards/dbus/1.0/introspect.dtd">
<node name="/uk/org/thekelleys/dnsmasq">
  <interface name="org.freedesktop.DBus.Introspectable">
    <method name="Introspect">
      <arg name="data" direction="out" type="s"/>
    </method>
  </interface>
  <interface name="org.freedesktop.NetworkManager.dnsmasq">
    <method name="ClearCache">
    </method>
    <method name="GetVersion">
      <arg name="version" direction="out" type="s"/>
    </method>
    <method name="GetLoopServers">
      <arg name="server" direction="out" type="as"/>
    </method>
    <method name="SetServers">
      <arg name="servers" direction="in" type="av"/>
    </method>
    <method name="SetDomainServers">
      <arg name="servers" direction="in" type="as"/>
    </method>
    <method name="SetServersEx">
      <arg name="servers" direction="in" type="aas"/>
    </method>
    <method name="SetFilterWin2KOption">
      <arg name="filterwin2k" direction="in" type="b"/>
    </method>
    <method name="SetBogusPrivOption">
      <arg name="boguspriv" direction="in" type="b"/>
    </method>
    <signal name="DhcpLeaseAdded">
      <arg name="ipaddr" type="s"/>
      <arg name="hwaddr" type="s"/>
      <arg name="hostname" type="s"/>
    </signal>
    <signal name="DhcpLeaseDeleted">
      <arg name="ipaddr" type="s"/>
      <arg name="hwaddr" type="s"/>
      <arg name="hostname" type="s"/>
    </signal>
    <signal name="DhcpLeaseUpdated">
      <arg name="ipaddr" type="s"/>
      <arg name="hwaddr" type="s"/>
      <arg name="hostname" type="s"/>
    </signal>
    <method name="AddDhcpLease">
       <arg name="ipaddr" type="s"/>
       <arg name="hwaddr" type="s"/>
       <arg name="hostname" type="ay"/>
       <arg name="clid" type="ay"/>
       <arg name="lease_duration" type="u"/>
       <arg name="ia_id" type="u"/>
       <arg name="is_temporary" type="b"/>
    </method>
    <method name="DeleteDhcpLease">
       <arg name="ipaddr" type="s"/>
       <arg name="success" type="b" direction="out"/>
    </method>
  </interface>
</node>
"

So there is SetServers, which NetworkManager presumably uses, and GetLoopServers, but not GetServers.

The second best thing we can do is send SIGUSR1 to dnsmasq. This makes it dump a status report to syslog containing statistics for each server:

$ sudo kill -USR1 $(pgrep dnsmasq)
$ sudo tail /var/log/syslog
...
... dnsmasq[927]: server 192.168.1.1#53: queries sent 2, retried or failed 0
... dnsmasq[927]: server 1.1.1.1#53: queries sent 2, retried or failed 0
... dnsmasq[927]: server 8.8.8.8#53: queries sent 25, retried or failed 0

I'm not sure whether these are only the servers currently in use, or whether the list also contains ones that have since been removed. But as far as I know, this is the most authoritative answer we can get.

Answer 3

We know that you obtain your IP address, DNS nameservers, etc. from a DHCP transaction with your router, switch or other access point. If yours was a static address, you would have been required to specify the DNS nameservers and you'd therefor already know the DNS servers effectively being used.

In a DHCP transaction, the DNS nameservers in the router are transferred to your connection. In fact, they may come, in turn, from the modem or internet appliance provided by your internet service provider.

You can probably specify the nameservers you prefer by accessing the administration pages of the router like this.

As well, you can direct Network Manager to use preferred nameservers, like this: remove isp-provided dns

Since the DNS nameservers vary by connection; that is, you will receive a different DNS nameserver connected at work from the nameserver connected at home, the provided numbers are shown in /etc/NetworkManager/system-connections/foo where foo is the name of the connection. For instance, one of my connections is Wired Connection 1 and it reports, among other entries:

[ipv4]
dns=8.8.8.8;8.8.4.4;
dns-search=
ignore-auto-dns=true
method=auto