resolved.conf.xml revision b5a8703fdb8e16f760bfb730df64f07173bb881d
a51c10485af349eb15faa4d1a63b9818bcf3e589Lennart Poettering<?xml version='1.0'?> <!--*- Mode: nxml; nxml-child-indent: 2; indent-tabs-mode: nil -*-->
091a364c802e34a58f3260c9cb5db9b75c62215cTom Gundersen<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
12b42c76672a66c2d4ea7212c14f8f1b5a62b78dTom Gundersen "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
091a364c802e34a58f3260c9cb5db9b75c62215cTom Gundersen This file is part of systemd.
091a364c802e34a58f3260c9cb5db9b75c62215cTom Gundersen Copyright 2014 Tom Gundersen
091a364c802e34a58f3260c9cb5db9b75c62215cTom Gundersen systemd is free software; you can redistribute it and/or modify it
091a364c802e34a58f3260c9cb5db9b75c62215cTom Gundersen under the terms of the GNU Lesser General Public License as published by
091a364c802e34a58f3260c9cb5db9b75c62215cTom Gundersen the Free Software Foundation; either version 2.1 of the License, or
091a364c802e34a58f3260c9cb5db9b75c62215cTom Gundersen (at your option) any later version.
091a364c802e34a58f3260c9cb5db9b75c62215cTom Gundersen systemd is distributed in the hope that it will be useful, but
091a364c802e34a58f3260c9cb5db9b75c62215cTom Gundersen WITHOUT ANY WARRANTY; without even the implied warranty of
091a364c802e34a58f3260c9cb5db9b75c62215cTom Gundersen MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
091a364c802e34a58f3260c9cb5db9b75c62215cTom Gundersen Lesser General Public License for more details.
091a364c802e34a58f3260c9cb5db9b75c62215cTom Gundersen You should have received a copy of the GNU Lesser General Public License
091a364c802e34a58f3260c9cb5db9b75c62215cTom Gundersen along with systemd; If not, see <http://www.gnu.org/licenses/>.
f2dacc96b25528ca1b0caca6364a69d656cf1569Josh Triplett<refentry id="resolved.conf" conditional='ENABLE_RESOLVED'
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek xmlns:xi="http://www.w3.org/2001/XInclude">
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <productname>systemd</productname>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <refentrytitle>resolved.conf</refentrytitle>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <refname>resolved.conf</refname>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <refname>resolved.conf.d</refname>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <refpurpose>Network Name Resolution configuration files</refpurpose>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <refsynopsisdiv>
12b42c76672a66c2d4ea7212c14f8f1b5a62b78dTom Gundersen <para><filename>/etc/systemd/resolved.conf</filename></para>
12b42c76672a66c2d4ea7212c14f8f1b5a62b78dTom Gundersen <para><filename>/etc/systemd/resolved.conf.d/*.conf</filename></para>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <para><filename>/run/systemd/resolved.conf.d/*.conf</filename></para>
12b42c76672a66c2d4ea7212c14f8f1b5a62b78dTom Gundersen <para><filename>/usr/lib/systemd/resolved.conf.d/*.conf</filename></para>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek </refsynopsisdiv>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <para>These configuration files control local DNS and LLMNR
a8eaaee72a2f06e0fb64fb71de3b71ecba31dafbJan Engelhardt name resolution.</para>
e93549ef29c4123d9ee45acb5815048390201e49Zbigniew Jędrzejewski-Szmek <xi:include href="standard-conf.xml" xpointer="main-conf" />
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <variablelist class='network-directives'>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <term><varname>DNS=</varname></term>
b938cb902c3b5bca807a94b277672c64d6767886Jan Engelhardt <listitem><para>A space-separated list of IPv4 and IPv6
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek addresses to be used as system DNS servers. DNS requests are
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek sent to one of the listed DNS servers in parallel to any
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek per-interface DNS servers acquired from
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
a51c10485af349eb15faa4d1a63b9818bcf3e589Lennart Poettering For compatibility reasons, if this setting is not specified,
9f2912db7887d82f95183d51f4af4db99454f6f4Lennart Poettering the DNS servers listed in
9f2912db7887d82f95183d51f4af4db99454f6f4Lennart Poettering <filename>/etc/resolv.conf</filename> are used instead, if
9f2912db7887d82f95183d51f4af4db99454f6f4Lennart Poettering that file exists and any servers are configured in it. This
9f2912db7887d82f95183d51f4af4db99454f6f4Lennart Poettering setting defaults to the empty list.</para></listitem>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <term><varname>FallbackDNS=</varname></term>
b938cb902c3b5bca807a94b277672c64d6767886Jan Engelhardt <listitem><para>A space-separated list of IPv4 and IPv6
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek addresses to be used as the fallback DNS servers. Any
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek per-interface DNS servers obtained from
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek take precedence over this setting, as do any servers set via
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <varname>DNS=</varname> above or
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <filename>/etc/resolv.conf</filename>. This setting is hence
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek only used if no other DNS server information is known. If this
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek option is not given, a compiled-in list of DNS servers is used
a51c10485af349eb15faa4d1a63b9818bcf3e589Lennart Poettering <varlistentry>
a51c10485af349eb15faa4d1a63b9818bcf3e589Lennart Poettering <listitem><para>A space-separated list of search domains. For
a51c10485af349eb15faa4d1a63b9818bcf3e589Lennart Poettering compatibility reasons, if this setting is not specified, the
a51c10485af349eb15faa4d1a63b9818bcf3e589Lennart Poettering search domains listed in <filename>/etc/resolv.conf</filename>
a51c10485af349eb15faa4d1a63b9818bcf3e589Lennart Poettering are used instead, if that file exists and any domains are
a51c10485af349eb15faa4d1a63b9818bcf3e589Lennart Poettering configured in it. This setting defaults to the empty
a51c10485af349eb15faa4d1a63b9818bcf3e589Lennart Poettering </varlistentry>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <term><varname>LLMNR=</varname></term>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <listitem><para>Takes a boolean argument or
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <literal>resolve</literal>. Controls Link-Local Multicast Name
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek Resolution support (<ulink
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek url="https://tools.ietf.org/html/rfc4795">RFC 4794</ulink>) on
b938cb902c3b5bca807a94b277672c64d6767886Jan Engelhardt the local host. If true, enables full LLMNR responder and
a8eaaee72a2f06e0fb64fb71de3b71ecba31dafbJan Engelhardt resolver support. If false, disables both. If set to
a8eaaee72a2f06e0fb64fb71de3b71ecba31dafbJan Engelhardt <literal>resolve</literal>, only resolution support is enabled,
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek but responding is disabled. Note that
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek also maintains per-interface LLMNR settings. LLMNR will be
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek enabled on an interface only if the per-interface and the
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek global setting is on.</para></listitem>
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering <varlistentry>
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering <listitem><para>Takes a boolean argument or
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering <literal>downgrade-ok</literal>. If true all DNS lookups are
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering DNSSEC-validated locally. If a response for a lookup request
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering is detected invalid this is returned as lookup failure to
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering applications. Note that this mode requires a DNS server that
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering supports DNSSEC. If the DNS server does not properly support
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering DNSSEC all validations will fail. If set to
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering <literal>downgrade-ok</literal> DNSSEC validation is
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering attempted, but if the server does not support DNSSEC properly,
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering DNSSEC mode is automatically disabled. Note that this mode
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering makes DNSSEC validation vulnerable to "downgrade" attacks,
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering where an attacker might be able to trigger a downgrade to
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering non-DNSSEC mode by synthesizing a DNS response that suggests
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering DNSSEC was not supported. If set to false, DNS lookups are not
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering DNSSEC validated.</para>
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering <para>Note that DNSSEC validation requires retrieval of
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering additional DNS data, and thus results in a small DNS look-up
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering time penalty.</para>
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering <para>DNSSEC requires knowledge of "trust anchors" to prove
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering data integrity. The trust anchor for the Internet root domain
b5a8703fdb8e16f760bfb730df64f07173bb881dLennart Poettering is built into the resolver, additional trust anchors may be
b5a8703fdb8e16f760bfb730df64f07173bb881dLennart Poettering <citerefentry><refentrytitle>dnssec-trust-anchors.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
b5a8703fdb8e16f760bfb730df64f07173bb881dLennart Poettering Trust anchors may change in regular intervals, and old trust
b5a8703fdb8e16f760bfb730df64f07173bb881dLennart Poettering anchors may be revoked. In such a case DNSSEC validation is
b5a8703fdb8e16f760bfb730df64f07173bb881dLennart Poettering not possible until new trust anchors are configured locally or
b5a8703fdb8e16f760bfb730df64f07173bb881dLennart Poettering the resolver software package is updated with the new root
b5a8703fdb8e16f760bfb730df64f07173bb881dLennart Poettering trust anchor. In effect, when the built-in trust anchor is
b5a8703fdb8e16f760bfb730df64f07173bb881dLennart Poettering revoked and <varname>DNSSEC=</varname> is true, all further
b5a8703fdb8e16f760bfb730df64f07173bb881dLennart Poettering lookups will fail, as it cannot be proved anymore whether
b5a8703fdb8e16f760bfb730df64f07173bb881dLennart Poettering lookups are correctly signed, or validly unsigned. If
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering <literal>downgrade-ok</literal> the resolver will
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering automatically turn of DNSSEC validation in such a case.</para>
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering <para>Client programs looking up DNS data will be informed
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering whether lookups could be verified using DNSSEC, or whether the
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering returned data could not be verified (either because the data
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering was found unsigned in the DNS, or the DNS server did not
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering support DNSSEC or no appropriate trust anchors were known). In
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering the latter case it is assumed that client programs employ a
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering secondary scheme to validate the returned DNS data, should
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering this be required.</para>
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering <para>It is recommended to set <varname>DNSSEC=</varname> to
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering true on systems where it is kown that the DNS server supports
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering DNSSEC correctly, and where software or trust anchor updates
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering happen regularly. On other systems it is recommended to set
519d39deeeec7121649f28e7287b7790e50d2979Lennart Poettering </varlistentry>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
b5a8703fdb8e16f760bfb730df64f07173bb881dLennart Poettering <citerefentry><refentrytitle>dnssec-trust-anchors.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <citerefentry><refentrytitle>resolv.conf</refentrytitle><manvolnum>4</manvolnum></citerefentry>