shell-things/etc/systemd/resolved.conf.d

systemd-resolved additional config files

• Quickstart
• Files explained
• General commentary

Quickstart

sudo systemctl enable --now systemd-resolved.service
sudo ln -rsf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
# After changing configuration
sudo systemctl restart systemd-resolved

Files explained

• 00-defaults.conf - configuration that should be used everywhere. Enables DNSSEC (regardless of systemd-resolved not handling it properly), enables opportunistic DoT, caching and local DNS servers (because they should exist anyway as I don’t trust systemd-resolved entirely. Anyway if there truly is no local resolver, systemd-resolved will detect that and act accordingly.)
  • To rephrase, this is to be used together with other files, especially some of those beginning with 10-dot-.
• 05-do53-dna-moi.conf - DNS servers used by DNA and Moi (who is on DNA’s network and owned by them)
• 05-do53-elisa.conf - DNS servers used by Elisa and apparently their Saunalahti still exists here as well.
• 10-dot-*.conf - configuration to use the DNS provider with DNS-over-TLS. At least one of these should be used in addition to 00-defaults.conf
• 98-local-resolver.conf attempts to configure localhost resolver and disables unnecessary features for that scenario. The number 10 takes priority over 00 and 05 so if a DNSOverTLS=true is uncommented, it will also apply to the former ones that are unlikely to support it. When numbering the files, I didn’t think I would be adding the plaintext DNS servers that I am unlikely to use whenever Unbound is available (and I currently have only one system that has systemd-resolved while not having Unbound and it seems to prefer DoT over my router anyway).
• 99-lan-resolver.conf.sample when renamed would allow enabling resolvers on LAN assuming they are trusted. Note that if used together with 98-local-resolver.conf, DNSSEC would be disabled.
• README.md - you are reading it right now.

General commentary

• DNSOverTLS became supported in systemd v239, strict mode (true) in v243 (big improvements in v244).
  • TODO: find out when SNI became supported, I have just spotted it in the fine manual in 2020-06-??.
• Domains has to be .~ for them to override DHCP. See https://www.internetsociety.org/blog/2018/12/dns-privacy-in-linux-systemd without which I wouldn’t have got this right.
• DNSSEC may not work if the system is down for a long time and not updated. Thus allow-downgrade may be better for non-tech people, even with the potential downgrade attack. There are also captive portals, affecting DNSOverTLS. Both take true or false or their own special option, for DNSSEC the allow-downgrade, for DNSOverTLS opportunistic.
  • Then again when was any system that outdated to not have working DNSSEC?
    • TODO: return to this configuration should that actually happen?
    • I am actually running Unbound simultaneously with resolv.conf pointing to both with options rotate edns0 trust-ad which might workaround that potential issue.

Other links I have found important and my files are based on:

• https://wiki.archlinux.org/index.php/Systemd-resolved
  • Also provides the serious issues systemd-resolved+DNSSEC issues, https://github.com/systemd/systemd/issues/10579 & https://github.com/systemd/systemd/issues/9867
• request for strict DoT: https://github.com/systemd/systemd/issues/10755
• vulnerable to MITM: https://github.com/systemd/systemd/issues/9397