After a lot of testing and trial and error, I think I found a working solution.
I decided to remove all the configurations I had done, re-read the docs, and started from scratch.
systemd-resolved
now has the following global configuration (at /etc/systemd/resolved.conf.d/
)
[Resolve]
DNS=...
DNSOverTLS=opportunistic
Domains=~.
NetworkManager has the following global config:
[main]
dns=systemd-resolved
I removed all NetworkManager dispatcher scripts. And that’s it! The good old KISS principle strikes again
I believe the key points were: providing a global DNS config, setting DNSOverTLS
to opportunistic, and setting the default Domains to ~.
With this, DNS queries with the work domain are being directed to work DNS, and all others to NextDNS (regardless if am physically at home or work)
I don’t claim this is the proper way to do it, but I am glad this is (finally!) working I’ll mark this as the solution, but if anyone has any improvement to contribute, I will be more than happy to include it here.
Thanks to all that helped!