LFCS 159 🐧 DNS Client Configuration - KandZ

⏱️ Estimated read: 9 min | |

The previous chapters covered the web servers that respond to the HTTP requests. This chapter returns to the networking layer: the DNS client configuration. The LFCS exam lists “Configure DNS” and “Use tools to troubleshoot DNS issues” under the Networking domain . The DNS client configuration is the set of files and services that determine how the system resolves the hostnames to the IP addresses. The critical trap is the persistence problem: editing /etc/resolv.conf directly works until the next reboot or the network restart, when the NetworkManager or the systemd-resolved overwrites the file. The persistent configuration is in the network manager settings or the resolved.conf, not in the resolv.conf.

Key point: The resolv.conf is the runtime DNS configuration. The nameserver directive sets the DNS server. The search directive sets the domain suffixes for the unqualified names. The nsswitch.conf file controls the resolution order: the hosts: files dns line checks the /etc/hosts first, then the DNS. The systemd-resolved is the modern resolver service that listens on 127.0.0.53. The persistent DNS configuration is in the /etc/systemd/resolved.conf or the NetworkManager connection settings .

Why DNS client configuration requires a specific mental model

The overwrite problem. The /etc/resolv.conf is the file that the applications read for the DNS servers. But on the modern systems, it is not the file that the administrator should edit. The systemd-resolved generates the resolv.conf from its own configuration. The NetworkManager generates it from the connection settings. The direct edit is overwritten on the next reboot or the network restart . The persistent configuration is in the source file, not the generated file.

The resolution order problem. The /etc/nsswitch.conf file controls the order of the resolution. The hosts: files dns line means the /etc/hosts is checked first, and if no match is found, the DNS is queried. The files is the /etc/hosts. The dns is the resolv.conf and the DNS servers. The order matters: the /etc/hosts entry overrides the DNS record for the same name . The getent hosts example.com command uses the same order as the application, which is the correct test.

The systemd-resolved problem. The systemd-resolved is the local resolver that caches the DNS results and provides the 127.0.0.53 stub. The resolvectl status shows the current DNS servers, the search domains, and the DNS over TLS settings. The resolvectl query example.com resolves the name through the systemd-resolved and shows the server that answered . The systemctl status systemd-resolved confirms the service is running.

The search domain problem. The search directive in the resolv.conf sets the suffixes for the unqualified names. The search example.com internal.corp means the query for db01 tries db01.example.com first, then db01.internal.corp. The ndots option controls how many dots a name must have before the resolver tries it as an absolute name first . The search domain is the convenience for the internal names, but it can cause the unexpected resolution if the name is not fully qualified.

The DNS over TLS problem. The systemd-resolved supports the DNS over TLS (DoT). The DNSOverTLS=yes in the resolved.conf encrypts the DNS queries. The resolvectl status shows whether the DoT is enabled. The DoT is the security feature, but it requires the DNS server to support it .

The trade-off. The direct resolv.conf edit is the quick fix for the testing. The persistent configuration is the correct fix for the production. The systemd-resolved is the modern resolver with the caching and the DoT. The NetworkManager is the integration with the connection profile. The exam tests the persistent configuration.

a. The `resolv.conf` and the `nsswitch.conf`

The /etc/resolv.conf is the runtime DNS configuration. The /etc/nsswitch.conf is the resolution order.

# View the runtime DNS config
cat /etc/resolv.conf
# nameserver 8.8.8.8
# nameserver 1.1.1.1
# search example.com
# options ndots:1 timeout:2

# View the resolution order
grep hosts /etc/nsswitch.conf
# hosts: files dns

The nameserver sets the DNS server. The search sets the suffix. The options sets the timeout and the ndots. The hosts: files dns means the /etc/hosts is checked first.

The /etc/hosts is the static override.

# Add a static entry
echo "192.168.1.50 db.internal.example.com db" | sudo tee -a /etc/hosts

# Verify the resolution uses the hosts file
getent hosts db
# 192.168.1.50 db.internal.example.com db

The getent hosts command uses the nsswitch.conf order. If the entry is in the /etc/hosts, the DNS is not queried. This is the mechanism for the local override .

b. The `systemd-resolved` configuration

The systemd-resolved is the modern resolver. The /etc/systemd/resolved.conf is the persistent configuration.

# Edit the persistent config
sudo tee /etc/systemd/resolved.conf <<'EOF'
[Resolve]
DNS=8.8.8.8 1.1.1.1
FallbackDNS=9.9.9.9
Domains=example.com
DNSOverTLS=no
EOF

# Restart the service
sudo systemctl restart systemd-resolved

# Check the status
resolvectl status

The DNS= sets the primary servers. The FallbackDNS= sets the fallback. The Domains= sets the search domains. The DNSOverTLS=no disables the encryption. The resolvectl status shows the current servers and the search domains per link .

The resolvectl query resolves the name through the systemd-resolved.

resolvectl query example.com
# example.com: 93.184.216.34
#   -- Information acquired via protocol DNS in 1.2ms.
#   -- Data is authenticated: no

The output shows the IP, the protocol, the time, and the authentication status. The systemd-resolved caches the result, so the second query is faster .

c. The NetworkManager and the persistent DNS

The NetworkManager stores the DNS in the connection profile. The nmcli command modifies the profile.

# Set the DNS for a connection
sudo nmcli connection modify "Wired connection 1" ipv4.dns "8.8.8.8 1.1.1.1"
sudo nmcli connection modify "Wired connection 1" ipv4.dns-search "example.com"

# Reactivate the connection
sudo nmcli connection up "Wired connection 1"

# Verify the resolv.conf is updated
cat /etc/resolv.conf

The ipv4.dns sets the DNS servers. The ipv4.dns-search sets the search domains. The connection up reactivates the profile and regenerates the resolv.conf. The resolv.conf is now generated by the NetworkManager, and the edit is persistent across the reboot .

The resolv.conf generated by the NetworkManager has the comment that it is generated.

# Generated by NetworkManager
nameserver 8.8.8.8
nameserver 1.1.1.1
search example.com

The comment is the signal that the file is not the source. The source is the NetworkManager connection profile .

Complete Example Session

# ============================================
# PART 1: VIEW THE RUNTIME CONFIG
# ============================================

cat /etc/resolv.conf
# nameserver 127.0.0.53
# search example.com

# ============================================
# PART 2: CHECK THE RESOLUTION ORDER
# ============================================

grep hosts /etc/nsswitch.conf
# hosts: files dns

# ============================================
# PART 3: TEST THE RESOLUTION
# ============================================

getent hosts example.com
# 93.184.216.34 example.com

# ============================================
# PART 4: ADD A HOSTS OVERRIDE
# ============================================

echo "127.0.0.1 test.local" | sudo tee -a /etc/hosts
getent hosts test.local
# 127.0.0.1 test.local

# ============================================
# PART 5: CONFIGURE systemd-resolved
# ============================================

sudo tee /etc/systemd/resolved.conf <<'EOF'
[Resolve]
DNS=8.8.8.8 1.1.1.1
Domains=example.com
EOF
sudo systemctl restart systemd-resolved

# ============================================
# PART 6: VERIFY THE RESOLVED CONFIG
# ============================================

resolvectl status
# DNS Servers: 8.8.8.8 1.1.1.1
# DNS Domain: example.com

# ============================================
# PART 7: QUERY VIA RESOLVED
# ============================================

resolvectl query example.com
# example.com: 93.184.216.34

# ============================================
# PART 8: CONFIGURE VIA NetworkManager
# ============================================

sudo nmcli connection modify "Wired connection 1" ipv4.dns "8.8.4.4"
sudo nmcli connection up "Wired connection 1"
cat /etc/resolv.conf
# nameserver 8.8.4.4

# ============================================
# PART 9: VERIFY THE PERSISTENT CONFIG
# ============================================

# Reboot and check the resolv.conf is the same.

The nine parts trace the DNS client config: view, nsswitch, test, hosts override, resolved config, verify, query, NetworkManager, and persistence verification.

Quick Reference

Runtime Files

File	Purpose
`/etc/resolv.conf`	Runtime DNS servers
`/etc/hosts`	Static overrides
`/etc/nsswitch.conf`	Resolution order

resolv.conf Directives

Directive	Purpose
`nameserver`	DNS server IP
`search`	Search domains
`options ndots:N`	Dots before absolute
`options timeout:N`	Query timeout

systemd-resolved

Command	Purpose
`resolvectl status`	Show DNS config
`resolvectl query <name>`	Resolve via resolved
`resolvectl flush-caches`	Clear cache
`systemctl restart systemd-resolved`	Apply config

NetworkManager

Command	Purpose
`nmcli con mod <con> ipv4.dns`	Set DNS
`nmcli con mod <con> ipv4.dns-search`	Set search
`nmcli con up <con>`	Apply

Best Practices

✅ Do This:

getent hosts example.com
<!-- Test the resolution path the app uses -->        # ✅

sudo nmcli connection modify "Wired connection 1" ipv4.dns "8.8.8.8"
<!-- Persistent DNS via NetworkManager -->           # ✅

resolvectl status
<!-- Check the resolved config -->                   # ✅

❌ Don’t Do This:

# Edit /etc/resolv.conf directly
<!-- Overwritten by NetworkManager or resolved -->    # ❌

# Assume /etc/hosts is checked after DNS
<!-- The nsswitch.conf order determines it -->        # ❌

# Use dig to test the app resolution
<!-- dig bypasses nsswitch; use getent -->           # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
DNS config lost on reboot	Edited `resolv.conf`	Use NetworkManager or resolved
Name resolves differently	`/etc/hosts` override	Check `nsswitch.conf` and hosts
`resolv.conf` points to 127.0.0.53	systemd-resolved stub	Use `resolvectl` or edit resolved.conf
Search domain not applied	No `search` directive	Add to NetworkManager or resolved
DNS query slow	Wrong timeout	Check `options timeout`

Real-World Examples

1. View resolv.conf

cat /etc/resolv.conf

2. View nsswitch

grep hosts /etc/nsswitch.conf

3. Test Resolution

getent hosts example.com

4. Add Hosts Override

echo "192.168.1.10 db.local" | sudo tee -a /etc/hosts

5. Resolved Status

resolvectl status

6. Resolved Query

resolvectl query example.com

7. NetworkManager DNS

sudo nmcli con mod "Wired connection 1" ipv4.dns "8.8.8.8"

8. Apply NetworkManager

sudo nmcli con up "Wired connection 1"

9. Flush Cache

sudo resolvectl flush-caches

10. Restart Resolved

sudo systemctl restart systemd-resolved

Visual

Resolution Flow

┌──────────────────────────────────────────────┐
│  Application calls getaddrinfo()             │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  nsswitch.conf: hosts: files dns             │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  1. /etc/hosts                               │
│     ├── Match → return IP                    │
│     └── No match → continue                  │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  2. DNS (resolv.conf)                        │
│     ├── Query 127.0.0.53 (systemd-resolved)  │
│     └── Query upstream nameservers           │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Return IP or NXDOMAIN                       │
└──────────────────────────────────────────────┘

Persistent vs Runtime

┌──────────────────────────────────────────────┐
│  Runtime: /etc/resolv.conf                   │
│  → Generated by NetworkManager or resolved   │
│  → Not the source                            │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Persistent:                                 │
│  ├── NetworkManager: nmcli ipv4.dns          │
│  └── systemd-resolved: /etc/systemd/resolved.conf│
└──────────────────────────────────────────────┘

Summary

Item	Value
Runtime DNS file	`/etc/resolv.conf`
Static overrides	`/etc/hosts`
Resolution order	`/etc/nsswitch.conf`
Modern resolver	`systemd-resolved`
Stub address	`127.0.0.53`
Resolved config	`/etc/systemd/resolved.conf`
Persistent via NM	`nmcli con mod ipv4.dns`
Test path	`getent hosts`

Key takeaways:

The resolv.conf is the runtime file, not the source. It is generated by the NetworkManager or the systemd-resolved. The direct edit is overwritten on the reboot. The persistent configuration is in the NetworkManager connection or the resolved.conf .
The nsswitch.conf controls the resolution order. The hosts: files dns line checks the /etc/hosts first. The getent hosts command uses the same order as the application, which is the correct test .
The systemd-resolved is the modern resolver. It listens on the 127.0.0.53 stub. The resolvectl status shows the current configuration. The resolvectl query resolves the name through the service .
The NetworkManager stores the DNS in the connection profile. The nmcli con mod ipv4.dns sets the servers. The nmcli con up applies the change and regenerates the resolv.conf .
The search domain is the convenience and the risk. It appends the suffix to the unqualified names. The ndots option controls when the name is tried as absolute first.

Remember: The resolv.conf is the runtime. The nsswitch.conf is the order. The hosts is the override. The resolved is the service. The NetworkManager is the persistence. The getent is the test. The exam tests the persistence and the resolution order.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!