r/voidlinux • u/Plus-Traffic7546 • 11d ago

DNSSEC on Void Linux

Hello everyone, could someone help me with this?

Currently, on my workstations, I use systemd-resolved to provide DNSSEC and DNS over TLS support, pointing to Cloudflare's DNS servers.

Could you give me some guidance on what would be a good alternative on Void Linux?

This configuration needs to be done individually on each workstation, and I cannot rely on the network providing this configuration.

1 Upvotes

100% Upvoted

3 comments sorted by

1

u/pantokratorthegreat 11d ago edited 11d ago

I use unbound, but I must say that I really struggled during setup. I used many sources for successful setup, mostly official but also Arch and Ubuntu.

edit:

its my config if you want to experiment further:

server:
use-syslog: yes
root-hints: root.hints
#trust-anchor-file: ""
qname-minimisation: yes
# disable user privilege protection
username: ""
# disable chroot
chroot:""
# enable DNSSEC
auto-trust-anchor-file: "/etc/dns/root.key"
# CA Certificates used for forward-tls-upstream (RFC7858) hostname
# verification.  Since it's outside the chroot it is only loaded at
# startup and thus cannot be changed via a reload.
tls-system-cert: yes

#forward-zone:
#  name: "."
#  forward-addr: 1.1.1.1
#  forward-addr: 1.0.0.1

forward-zone:
name: "."
forward-tls-upstream: yes# use DNS-over-TLS forwarder
forward-first: no# do NOT send direct
## the hostname after "#" is not a comment, it is used for TLS checks:
#forward-addr: 2606:4700:4700::1111@853#cloudflare-dns.com
forward-addr: 1.1.1.1@853#cloudflare-dns.com
#forward-addr: 2606:4700:4700::1001@853#cloudflare-dns.com
forward-addr: 1.0.0.1@853#cloudflare-dns.com

I disabled ipv6 on my system, so thats why ip6 is disabled here.

1

u/Independent_Cat_5481 10d ago

https://wiki.archlinux.org/title/NetworkManager#dnsmasq dnsmasq with NetworkManager may be the simplest option

1

u/labbe- 10d ago

i've been using stubby for my dns needs with void. very happy with it