Anatomy of a Linux DNS Lookup

https://zwischenzugs.com/2018/06/08/anatomy-of-a-linux-dns-lookup-part-i/

by belter • 5 years ago

168 49 5 years ago

zwischenzugs.com

belter• 5 years ago

Follow up:

Anatomy of a Linux DNS Lookup – Part II https://zwischenzugs.com/2018/06/18/anatomy-of-a-linux-dns-l...

Anatomy of a Linux DNS Lookup – Part III https://zwischenzugs.com/2018/07/06/anatomy-of-a-linux-dns-l...

Anatomy of a Linux DNS Lookup – Part IV https://zwischenzugs.com/2018/08/06/anatomy-of-a-linux-dns-l...

Anatomy of a Linux DNS Lookup – Part V – Two Debug Nightmares https://zwischenzugs.com/2018/09/13/anatomy-of-a-linux-dns-l...

necovek5• 5 years ago

This does not cover the joy of eg. connecting to multiple networks (different DNS settings) with separate interfaces.

Then you can hit DNS request hopping between servers too: https://github.com/systemd/systemd/issues/19209

iso163113• 5 years ago

Before networkmanager and systemd, pretty much every tool used gethostbyname, which used standard nsswitch which tended to be hosts, then resolv.conf

resolv.conf would use the first one, and then timeout and use the next one

Nice and simple.

The quote

"simply turn off systemd-resolved"

Is usually the answer, but it's a constant uphill battle to fix broken behaviour.

Of course Pottering doesn't care.

tyingq3• 5 years ago

This predates systemd's decision to get involved via systemd-resolved. So now it's got another step :)

Edit: Well, and also browsers doing DNS over https. It's pretty confusing these days to know which path your app took to resolve a name.

mike_d• 5 years ago

Which is super annoying when you actually want to run a DNS server and have to try and convince systemd-resolved to stay in its own lane.

westurner4• 5 years ago

Is there a good example of a Linux package that does this correctly?

iso163113• 5 years ago

Also predates netplan. NetworkManager (another redhat tool to makes things "simpler", like systemd) is mentioned in part 3.

I've used Debian based distributions for 20 years with nothing more than ifupdown, resolvconf, and occasionally dnsmasq, but no distro for old men and all that.

tyingq3• 5 years ago

"no distro for old men". Hah, that's great. I had a brief thought of a Javier Bardem as SystemD.

eikenberry2• 5 years ago

I did the same for years, with the addition of wireless tools when I switched to using laptops. With Buster and the additional networking features of systemd (and iwd for wifi), I was able to replace the whole stack with just 2-3 things. Much simpler in design and easier to setup and use.

I wrote a small gist on the setup a couple years ago that is still mostly relevant. In case you're interested... https://gist.github.com/eikenb/1e9faeb8210e639e8caa69e9832db...

znpy2• 5 years ago

I'm looking forward for "old men" to retire.

Stuff like systemd (and systemd-resolved) are wonderful innovation and that m god they're the de-facto standard on most desktops.

And by the way, the joy of systemd-resolved is in complex stuff that become surprisingly easy.

Example: split-horizon DNS. You're connected to a VPN network but you're only routing some subnets through that, not everything. Thus, you have to have DNS that query some DNS server inside the VPN for a set of domains, but keep using the usual DNS servers for everything else.

It's surprisingly easy with systemd-resolved, but I'm not aware of any feasibility without a DNS server running on the local machine (albeit in resolver mode). Which usually would be dnsmasq, but at that point you might as well run systemd-resolved.

zwischenzug• 5 years ago

Author here. I can’t believe I didn’t cover that as I spent ages fighting with it before writing this.

Writing those posts was incredibly cathartic, but I still left stuff out because I couldn’t get to the bottom of it. I do recall that configuring systemd resolved and finding useful docs for it was a nightmare.

Pirate-of-SV• 5 years ago

In Kubernetes you can also add NodeLocal DNSCache [1] as a DaemonSet that injects iptable rules to cache DNS locally to offload the in-cluster coredns.

[1] https://kubernetes.io/docs/tasks/administer-cluster/nodeloca...

mr-wendel• 5 years ago

Not to be overlooked on this topic is this wonderful Tailscale blog entry:

https://tailscale.com/blog/sisyphean-dns-client-linux/

and corresponding HN: https://news.ycombinator.com/item?id=26821298

  * disclaimer: I have no affiliation w/ Tailscale. I just wish I did.

economusty• 5 years ago

I recently had to circumvent the systemd resolvd auto config for dns it would randomly fail.

iso163113• 5 years ago

Quite normal - https://askubuntu.com/questions/907246/how-to-disable-system... for example

gtsop• 5 years ago

I actually went on to read this whole series a few months ago in search of what was wrong with some networking configuration I had at home. To no fault of the author, I felt like I trully learned a ton about DNS but couldn't apply that knowledge to solve my problem since ubuntu has added more stuff on top of these.

I feel like the DNS situation is way too complicated, I really don't even know where the tunnel ends anymore. I resulted to using the GUI and hope it handles everything, which I hate because I want to understand what's happening under the hood. I felt powerless

bandie91• 5 years ago

many of you complained that there is no lightweight way on Linux to have different resolvers for different domains/zones (eg. one default and one for your VPN or whatever).

see https://github.com/azukiapp/libnss-resolver - it's an NSS lib just like libnss_dns or libnss_files, which looks up resolv.conf-style files according to the queried domain suffix.

it's not a deamon.

i integrated it with dhcp client and ifup/down and use it happily for years.

disclaimer: i contributed to libnss_resolver.

deknos• 5 years ago

though the systemd-critique-people/hater have some vlaid points, i nowadays tend to ignore them.

most of them do not contribute in building better solutions, which help more people then themselves. just blabbering on and requiring stuff which only works for THEIR usecase. this is really annoying at times.

JoeyBananas• 5 years ago

I always forget about strace. I'm gonna use that trick

Anatomy of a Linux DNS Lookup

Related Stories