Issue to set up systemd DNS over TLS on Manjaro

Erz3 · 9 April 2021 13:38

I everyone, my level in english is not so hight but I will try explain me the best way.

I have been try to set up systemd , because I would like to use DoT on my DNS request. I have no problems with Ubuntu distro, I just set up /etc/systemd/system.conf.d/*.conf and work it.

However, with Manjaro I don’t know why don’t work. I have started systemd service and it is enabled but when I try test it with 1.1.1.1/help (Cloudflare test) I get this “No” in DoT requests.

When I edit the main file /etc/systemd/resolved.conf without “drop-ins” like above, and I do the same test (from Cloudflare) I get “Yes” in DoT requests but not always. I mean, I get “Yes” and in some cases “No” too.

I am running stable Manjaro 21.0.

Thanks in advance.

xabbu · 9 April 2021 14:56

Did you mean systemd-resolved? This is not that same as systemd.

This folder is for settings of systemd. But not for systemd-resolved. Use for systemd-resolved settings

/etc/systemd/resolved.conf.d

Also make sure that you actually use systemd-resolved.
You can find more infos in the Arch Wiki
https://wiki.archlinux.org/index.php/Systemd-resolved

Erz3 · 9 April 2021 23:20

Thanks you for your answer, I am not an experienced user on Linux. I feel Linux a litle confuse to find directories and software files locations, it feel messy.

I can’t follow your instructions until sunday so I will write in the future.

Erz3 · 11 April 2021 18:51

Alright, I have created a new file in /etc/systemd/resolved.conf.d/*.conf . “resolved.conf” was restored from default to work with “drop-ins”, also have been restarted “systemd-resolved” and “NetworkManager” services. However I get the same problem described on my first comment:

I don’t know what is happening, and worst of it, I don’t know if Dns Over Tls working or not. I have checked status from “systemd-resolved” and I have get this result:

So is it working or not? How could I check it?

Thanks in advance for your patience.

xabbu · 12 April 2021 15:55

Please do not post pictures of text.

Use wireshark and check the actual packages send to the DNS server.

XRaTiX · 12 April 2021 16:59

Did you type manually the DNS server to use with your connection? since you are using systemd dns resolver,you need to point to a local DNS to be able to use DNS over TLS in systemd,the DNS is 127.0.0.53

EDIT: Actually nevermind,looks like it works without you setting the DNS 127.0.0.53 manually,but give it a try just in case.

For example in KDE you put it like this

then restart the connection and you should now be using the systemd dns resolver.

EDIT:

I just did it in my machine to test it out,it works in my machine

Did you have this in your /etc/systemd/resolved.conf.d/dns_servers.conf? (or whatever the file is called)

[Resolve]
DNS=1.1.1.1
DNSOverTLS=yes

Erz3 · 19 April 2021 00:14

Forgive me.

Ok, I will try but I don’t know how to use Wireshark.

Some time ago I have been looking for information but I am not sure, first of all I need to set up port mirroring on my router, isn’t it? Anyway, thanks you.

I have done, but I get the same result doing Cloudflare test.

Do you get the same result every time refresh the website?

Yes.

Thanks you both for your answers

XRaTiX · 19 April 2021 01:34

Yes,in resolvectl status i have this

Global
           Protocols: +LLMNR +mDNS +DNSOverTLS DNSSEC=no/unsupported                                
    resolv.conf mode: foreign                                                                       
         DNS Servers: 1.1.1.1                                                                       
Fallback DNS Servers: 1.1.1.1 9.9.9.10 8.8.8.8 2606:4700:4700::1111 2620:fe::10 2001:4860:4860::8888

I only have this in the /etc/systemd/resolved.conf.d/dns_servers.conf remember

Make sure also to activate the service (or restart if you have it).

sudo systemctl restart systemd-resolved.service

In case still not working,you can try forcing the system to only use DNS by the systemd-resolved be aware that if systemd-resolved is not working correctly you will not have internet
Create a file in /etc/NetworkManager/conf.d/dns.conf and in there type

[main]
dns=systemd-resolved

Then restart the network manager

sudo systemctl restart NetworkManager.service

Check that the system is using the DNS of systemd-resolved only,the file /etc/resolv.conf should contain

# Generated by NetworkManager
  nameserver 127.0.0.53
  options edns0 trust-ad

Try using the internet,if internet is not working the systemd-resolved is not working properly then (because of no DNS resolver),i don’t know what the cause because everything you have looks ok…

Erz3 · 26 April 2021 19:58

I have got exactly the same settings like you but I continue with the previous issue, it’s so rare.

In the future I will sniffing the connection to test if DNS’s requests are going over tls or not.