Configuring Name Resolution on Ubuntu 26.04 LTS Server (systemd-resolved)

Checking and Configuring Name Resolution

Name resolution on Ubuntu 26.04 LTS Server is handled by systemd-resolved. It receives queries from applications and forwards them to the appropriate DNS server.

Because of this, editing /etc/resolv.conf does not change anything. Use resolvectl and Netplan instead.

What Is in /etc/resolv.conf

/etc/resolv.conf lists only 127.0.0.53, an address on the machine itself.

Commands to read resolv.conf
ls -l /etc/resolv.conf
cat /etc/resolv.conf

Example: reading resolv.conf
kazulog@sv1:~$ ls -l /etc/resolv.conf
lrwxrwxrwx 1 root root 39 Aug 24 01:24 /etc/resolv.conf -> ../run/systemd/resolve/stub-resolv.conf
kazulog@sv1:~$ cat /etc/resolv.conf
# This is /run/systemd/resolve/stub-resolv.conf managed by man:systemd-resolved(8).
# Do not edit.
#
# This file might be symlinked as /etc/resolv.conf. If you're looking at
# /etc/resolv.conf and seeing this text, you have followed the symlink.
#
# This is a dynamic resolv.conf file for connecting local clients to the
# internal DNS stub resolver of systemd-resolved. This file lists all
# configured search domains.
#
# Run "resolvectl status" to see details about the uplink DNS servers
# currently in use.
#
# Third party programs should typically not access this file directly, but only
# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
# different way, replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 127.0.0.53
options edns0 trust-ad
search kazulog.example
kazulog@sv1:~$

What to look at	Meaning
The symbolic link	The real file is `/run/systemd/resolve/stub-resolv.conf`, generated by systemd-resolved
`nameserver 127.0.0.53`	The local entry point (the stub resolver), not a real DNS server
`search`	The search domain, which is reflected here
`Do not edit.`	Edits are lost when the file is regenerated

Applications query 127.0.0.53 and systemd-resolved forwards to the real DNS servers. Those servers are configured elsewhere, so resolv.conf does not reveal them.

Reading the Current Settings

resolvectl status shows the DNS servers systemd-resolved actually uses.

Command to read the settings
resolvectl status

Example: reading the settings
kazulog@sv1:~$ resolvectl status
Global
         Protocols: -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
  resolv.conf mode: stub

Link 2 (ens2)
    Current Scopes: DNS
         Protocols: +DefaultRoute -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 10.1.0.1
       DNS Servers: 10.1.0.1 10.1.0.2
     Default Route: yes

Link 3 (ens3)
    Current Scopes: DNS
         Protocols: +DefaultRoute -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 192.168.100.1
       DNS Servers: 192.168.100.1 2001:db8:100::1
        DNS Domain: kazulog.example
     Default Route: yes
kazulog@sv1:~$

Field	Meaning
`Global`	Settings not tied to any interface
`Link N (name)`	Per-interface settings
`Current DNS Server`	The server currently being queried
`DNS Servers`	Servers configured on that interface
`DNS Domain`	The search domain

DNS servers are held per interface. With several interfaces, each may have its own servers, and the one used for a query is chosen from the name being resolved and each interface’s search domain. Use resolvectl status [INTERFACE] to look at one interface.

Configuring the DNS Servers

Permanent settings go in Netplan, in the same file described in Configuring the Network (Netplan).

Configuring DNS servers
network:
  version: 2
  ethernets:
    ens3:
      addresses:
        - 192.168.100.10/24
      nameservers:
        addresses: [192.168.100.1]
        search: [kazulog.example]

Key	Meaning
`nameservers.addresses`	DNS server addresses (more than one may be listed)
`nameservers.search`	Search domains (more than one may be listed)

After netplan apply, the output of resolvectl status changes.

Example: after applying the configuration
kazulog@sv1:~$ resolvectl status ens3
Link 3 (ens3)
    Current Scopes: DNS
         Protocols: +DefaultRoute -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 192.168.100.1
       DNS Servers: 192.168.100.1
        DNS Domain: kazulog.example
     Default Route: yes
kazulog@sv1:~$

Resolving a Name

resolvectl query reports which interface and which path produced the answer.

Command to resolve a name
resolvectl query [NAME]

Field	Value
[NAME]	The host name to resolve

Example: resolving names
kazulog@sv1:~$ resolvectl query www.kazulog.example
www.kazulog.example: 192.168.100.20            -- link: ens3

-- Information acquired via protocol DNS in 5.1987s.
-- Data is authenticated: no; Data was acquired via local or encrypted transport: no
-- Data from: network
kazulog@sv1:~$ resolvectl query www
www: 192.168.100.20                            -- link: ens3
     (www.kazulog.example)

-- Information acquired via protocol DNS in 7.0ms.
-- Data is authenticated: no; Data was acquired via local or encrypted transport: no
-- Data from: cache
kazulog@sv1:~$ resolvectl query sv1.kazulog.example
sv1.kazulog.example: 192.168.100.10            -- link: ens3

-- Information acquired via protocol DNS in 6.1378s.
-- Data is authenticated: no; Data was acquired via local or encrypted transport: no
-- Data from: network

Look at the last lines of each answer.

Output	Meaning
`-- link: ens3`	Which interface’s DNS was used
`Data from: network`	The answer came from a DNS server
`Data from: cache`	The answer came from the cache; no query was sent
`(www.kazulog.example)`	The name was completed with the search domain, shown when a short name was given

The second lookup uses the short name www, which the search domain kazulog.example completes. It is also far quicker than the first, because it came from the cache.

Precedence Against /etc/hosts

The order of lookup sources is set by the hosts: line in /etc/nsswitch.conf.

Command to check the order
grep '^hosts:' /etc/nsswitch.conf

Example: /etc/hosts taking precedence
kazulog@sv1:~$ grep '^hosts:' /etc/nsswitch.conf
hosts:          files dns
kazulog@sv1:~$ grep kazulog /etc/hosts
192.168.100.99 www.kazulog.example
kazulog@sv1:~$ resolvectl query www.kazulog.example
www.kazulog.example: 192.168.100.99

-- Information acquired via protocol DNS in 3.0ms.
-- Data is authenticated: yes; Data was acquired via local or encrypted transport: yes
-- Data from: synthetic
kazulog@sv1:~$ getent hosts www.kazulog.example
192.168.100.99  www.kazulog.example

The order is files dns, so /etc/hosts wins over DNS. Above, the DNS server answers 192.168.100.20 for the name while /etc/hosts supplies 192.168.100.99, and the latter is returned.

Note also that resolvectl query reports Data from: synthetic, meaning systemd-resolved built the answer from /etc/hosts.

Changing the DNS Server Temporarily

For a temporary change, use resolvectl dns.

Command for a temporary change
sudo resolvectl dns [INTERFACE] [ADDRESS]

Example: a temporary change and undoing it
kazulog@sv1:~$ resolvectl dns ens3
Link 3 (ens3): 192.168.100.1
kazulog@sv1:~$ sudo resolvectl dns ens3 192.168.100.20
kazulog@sv1:~$ resolvectl dns ens3
Link 3 (ens3): 192.168.100.20
kazulog@sv1:~$ sudo netplan apply
kazulog@sv1:~$ resolvectl dns ens3
Link 3 (ens3): 192.168.100.20
kazulog@sv1:~$ sudo resolvectl revert ens3
kazulog@sv1:~$ resolvectl dns ens3
Link 3 (ens3): 192.168.100.1

netplan apply does not undo it. A change made with resolvectl dns is kept as a runtime override. Use resolvectl revert to return to the configured value.

Command to undo a runtime change
sudo resolvectl revert [INTERFACE]

In the example above the value stays as set after netplan apply, and only resolvectl revert restores the address from Netplan.

Inspecting the Cache

systemd-resolved caches answers. resolvectl statistics reports on it.

Command to read the cache statistics
sudo resolvectl statistics

Example: the cache statistics
kazulog@sv1:~$ sudo resolvectl statistics
Transactions
                       Current Transactions:  0
                         Total Transactions: 57
                                               
Cache                                          
                         Current Cache Size:  0
                                 Cache Hits: 27
                               Cache Misses: 33
                                               
Failure Transactions                           
                             Total Timeouts:  3
         Total Timeouts (Stale Data Served):  0
                    Total Failure Responses:  2
Total Failure Responses (Stale Data Served):  0
                                               
DNSSEC Verdicts                                
                                     Secure:  0
                                   Insecure:  0
                                      Bogus:  0
                              Indeterminate:  0

Field	Meaning
`Cache Hits` / `Cache Misses`	Answers served from the cache, and lookups that required a query
`Current Cache Size`	Entries currently held
`Total Timeouts`	Lookups that received no answer

Clear the cache when a change on the DNS server is not visible yet.

Command to clear the cache
sudo resolvectl flush-caches

If You Really Want a Static resolv.conf

Normally, do not edit it: systemd-resolved regenerates the file.

If a static file is unavoidable, remove the symbolic link and put an ordinary file in its place. You then lose what systemd-resolved provides, such as per-interface DNS servers and the cache. Configuring it through Netplan is the correct approach.

Test Environment and Session Logs

The examples were captured on CML with Ubuntu 26.04 LTS Server (sv1) and a Cisco router (R1). R1 acts as the DNS server, so the names are resolved for real.

The test topology
  sv1 (Ubuntu 26.04)              R1 (IOS XE)
   ens3 192.168.100.10/24          Gi2 192.168.100.1/24
   DNS: 192.168.100.1              ip dns server
   search: kazulog.example         www.kazulog.example  = 192.168.100.20
      |                            sv1.kazulog.example  = 192.168.100.10
      +---------- LAB-SW ----------+

Step	Session log
Initial state (resolv.conf and resolvectl status)	show
Configuring the DNS server and resolving names	show
Precedence against /etc/hosts	show
Cache statistics	show
A temporary change and undoing it	show

The configuration files and syslog of each step were saved as well.

Step	Configuration	syslog
Initial state	conf	log
Configuring the DNS server	conf	log
Adding the /etc/hosts entry	conf	log

Records from R1, which served as the DNS server. The running-config is the configuration under test.

R1	show output	syslog	running-config
Acting as the DNS server	show	log	run

Reference

systemd-resolved.service(8) - systemd documentation