Yrurtj

I would like my newer GNU/Linux system (Ubuntu 18.04 LTS) to use a single, manually-configured, DNS server for all DNS queries. In the past, I could simply do echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.conf to clobber the /etc/resolv.conf file and persistently set the DNS server's IP address for my entire system.

On this (and many newer GNU/Linux distributions), /etc/resolv.conf is managed by the resolvconf(8) utilties. On Ubuntu 18.04, this file contains a line like this:

nameserver 127.0.0.53

As can see by sudo ss --listening --numeric --processes, the local system's systemd-resolved DNS stub resolver is bound to this IP address and is listening on port 53 for incoming DNS requests. Therefore, the above nameserver line in the /etc/resolv.conf file is directing all applications that do not use systemd-resolved's D-Bus or glibc API to the systemd-resolved service via "normal" DNS requests.

That's all fine and well, but all this means that I can no longer simply write persistent changes to the /etc/resolv.conf file in order to effect a nameserver change.

After reading numerous manual pages and blog posts, I learned that I could set "global" DNS nameserver IP address(es) by editing, for example, the /etc/systemd/resolve.conf file such that this file contained a line as follows:

DNS=1.1.1.1 9.9.9.9

After making this change and invoking sudo systemctl restart systemd-resolved, running systemd-resolve --status did show the new nameservers (1.1.1.1 and 9.9.9.9) in the "Global" section. However, a Wireshark packet capture confirmed that my system was still sending DNS queries to the "per-link" DNS server presumably configured via DHCP (say, 192.168.1.1).

Further experimentation lead me to add the following line to my /etc/systemd/resolve.conf file:

Domains=~.

This seems to have successfully instructed systemd-resolved to always use the global nameservers (set in the DNS= option) and to never query any DHCP-supplied nameservers, even though those nameservers still show up when I inspect the output of systemd-resolve --status.

Finally my questions: Aside from the obvious impact this will have on, say, ignoring VPN-supplied DNS information, what other potential impact will this have on my system? And, more importantly, is there a recommended way to completely override dynamically-configured nameserver settings, such as those provided by DHCP, on a system using systemd-resolved such as Ubuntu 18.04 that is more complete than simply editing each NetworkManager-managed connection via the GUI? In particular, I do not want to have to edit the DNS settings for each individual Wi-Fi network that I join; I want all connections to automatically always use statically-configured nameservers for DNS resolution. What is the "best" way to do that, and why?

Thank you.