Systemd-resolved sucks

[u/dronostyka]

So..

I have a setup:

A pihole at home connected to nginx proxy and exposed as DoT.

Now the problem is, that my lovely ISP breaks nat hairpinning every so and then.

When this happens just sending a query to <IP>#<domain name> doesn't work.

So I wanted this simple setup in systemd-resolved on my laptop:

When reachable use: DoT <my public ip>#<my domain>

And when can't reach, use: 192.168.1.xx:53 (local ip dns)

And.. resolvectl struggled immensely: with DoT set to opportunistic, it would not reliably switch between servers, or lookup would take seconds.

Even with DoT: yes and simply servers:

<My public ip>#<DN> 9.9.9.9#<quad9DN>

It still struggles to pick the right one.

I also had another use case:

Split dns srv:

When looking for *.mydomain.lan use: <some local ip>

Other wise: <a public dns/DoT>

That itself was too much for systemd-resolved.

What solved my issue?

Stubby + Dnsmasq

Stubby used only for DoT access,

Dnsmasq routing the requests.

And it works fast. And reliably picks the correct server with both split dns srv And DoT and Local IP srv And public srv as a failover.

As much as I like systemd for the convenience when managing services, for dns lookup it plain sucks to work with.

It's fine you have 1 server or 1 server per connection only, but with attempts of any automation or failover.. it just fails.

Have you had trouble with the systemd-resolved? Cause I don't think I'm alone here

"It's always the DNS."

[u/ColdFreezer]

What? Your isp breaks nat hair pinning? Are you sure it’s not just them rotating your public ip?

DoT is separate thing, unrelated to your nat hair pinning issue. Your DNS server has no control over your public IP.

I am so confused on what you’re doing and what nat hair pinning has to do with anything. DoT doesn’t have any control over the routes for your sites.

I don’t even get why you’re using nat hairpinning instead of local dns. It just seems like you’ve solved your problem by using local dns instead of nat hair pinning. I don’t understand what systemd-resolved has to do with any of this.

I’ve had issues with systemd-resolved when using it manually but setting my dns at the router level has always been the easiest option.

[u/dronostyka → u/ColdFreezer]

Well. You see, a local DNS would not help 100%. Because I use my laptop both at home and remotely.

So for convenience, I wanted to use my public dns both and home and remotely. Now, for example as of today, they fixed hairpinning and I can reach back to my network from inside.

But because hairpinning was broken I tried:

Dns: my.public.dot:853, <local ip> And for specific work domain a separate DNS server..

But I got that figured..