Systemd-resolved with DoT and DNSSEC configuration

Ask Fedora
, , , ,
1

Hello there!

I have disabled since F38 my systemd-resolve configuration because it stopped working out of nowhere… and forgot about it.

Did various modifications to the resolved.conf, but I’m sill not able to navigate the Internet if I keep any configurations with DoT with or without DNSSEC. Commenting them out restores my navigation.

/etc/NetworkManager/conf.d/10-dns-systemd-resolved.conf
[main]
dns=systemd-resolved
systemd-resolved=false

/etc/systemd/resolved.conf
[Resolve]
DNS=9.9.9.11 1.1.1.1
DNSOverTLS=yes
DNSSEC=yes
FallbackDNS=9.9.9.9 1.0.0.1
Domains=~.
#LLMNR=yes
#MulticastDNS=yes
Cache=yes
#DNSStubListener=yes
#ReadEtcHosts=yes

resolvectl query fedoraproject.org
fedoraproject.org: resolve call failed: All attempts to contact name servers or networks failed

~
resolvectl query openwrt.org
openwrt.org: resolve call failed: All attempts to contact name servers or networks failed

~
resolvectl query ddg.co
ddg.co: resolve call failed: All attempts to contact name servers or networks failed

I tested with various public DNS with and without DNSSEC (Quad9, CloudFlare, Mullvad, OpenDNS, AdGuard…), disabled and flushed cache, removed the fallbacks,

Did the configuration method changed? Is it a bug?

2

It works fine for me like this:

# Comment out custom settings
sudo sed -i -e "/^[^[#]/s/^/#/" /etc/systemd/resolved.conf

# Set up systemd-resolved
sudo mkdir -p /etc/systemd/resolved.conf.d
sudo tee /etc/systemd/resolved.conf.d/00-custom.conf << EOF > /dev/null
[Resolve]
DNS=8.8.8.8#dns.google
DNS=8.8.4.4#dns.google
DNS=2001:4860:4860::8888#dns.google
DNS=2001:4860:4860::8844#dns.google
DNSOverTLS=yes
EOF
sudo systemctl enable systemd-resolved.service
sudo systemctl restart systemd-resolved.service

# Prevent NetworkManager from changing resolvers
sudo tee /etc/NetworkManager/conf.d/00-custom.conf << EOF > /dev/null
[main]
dns=none
systemd-resolved=false
EOF
sudo systemctl restart NetworkManager.service
3

Thanks for the tip, but it also did not work for me.

4

There must be something wrong with your setup or configuration.
Start with basic diagnostics:

grep -v -r -e "^#" -e "^$" /etc/systemd/resolved.*
grep -v -e "^#" -e "^$" /etc/resolv.conf
grep -e ^hosts: /etc/nsswitch.conf
resolvectl --no-pager status
resolvectl --no-pager query example.org
systemctl status systemd-resolved.service
journalctl --no-pager -b -u systemd-resolved.service