Networking Documentation DNS Security Previous page: Networking Index page: Documentation Next page: DNS Security DNS

DNS

Default DNS Configuration

Linux Default DNS Mechanism

On Linux, DNS libraries read the /etc/resolv.conf file. A DNS-resolving client such as Unbound is optional and not strictly required for basic DNS resolution.

/etc/resolv.conf

Purpose: The /etc/resolv.conf file is a standard configuration file in Linux systems used by DNS resolver libraries (like glibc) to determine how to perform DNS resolution.
Contents: It typically contains information such as:
- nameserver directives specifying the IP addresses of DNS servers.
- search domains and options for resolving queries.

DNS Resolver Libraries

These libraries are part of most Linux systems and use /etc/resolv.conf to send DNS queries to the specified nameservers.
The libraries themselves handle basic DNS resolution without needing an external DNS resolver client.

DNS Resolver Clients

E.g., unbound, systemd-resolved.

Optional: External DNS resolving software like unbound or systemd-resolved is not strictly required for basic DNS resolution.
Purpose: These tools provide additional functionality, such as caching, advanced DNSSEC validation, or recursive DNS resolution.
Integration: When such a resolver is used, /etc/resolv.conf might point to 127.0.0.1 (localhost), as the local resolver handles DNS queries before forwarding them.

Summary

Basic DNS resolution on Linux relies on resolver libraries using /etc/resolv.conf.
External DNS resolving clients like unbound are optional and primarily used to enhance DNS functionality. They are not required for basic operations if a valid nameserver is defined in /etc/resolv.conf.

Disable DNS

Disable System DNS

System DNS only. Not all DNS. See next chapter for all DNS.

1. Prerequisite knowledge:

write protection

2. Backup the DNS configuration file /etc/resolv.conf.

Optional. Might make re-enabling DNS later easier. Might be difficult or impossible for many users without this step.

sudo cp /etc/resolv.conf ~/resolv.conf

3. Clear DNS configuration file.

sudo overwrite /etc/resolv.conf ""

4. Enable write protection.

Optional. Useful to avoid future operating system updates overwriting the file such as when a distribution or derivative (such as Debian, Qubes Debian or Kicksecure) stat shipping a DNS configuration file. Note, if that was ever the case the upgrade of the package will fail and the user will be notified through the usual package manager (apt-get) output. This might happen if/when Kicksecure implements DNS Security. Forum discussion: use DNSCrypt by default in Kicksecure

sudo chattr +i /etc/resolv.conf

5. Done.

System DNS has been disabled.

Disable All DNS

Many applications do actually not use system DNS but their own internal DNS implementation.DNS Security, chapter Potential Obstacles

Enabling systemd-resolved

Only for users that have a specific reason to want to use systemd-resolved.

Untested!

Warning: This is for testers-only!

Advanced users only!

Optional!

sudo touch /etc/dns-enable

sudo apt install systemd-resolved

sudo systemctl enable systemd-resolved

sudo systemctl start systemd-resolved

Networking Documentation DNS Security Previous page: Networking Index page: Documentation Next page: DNS Security

Kicksecure

A secure by default operating system with the latest security research in place.

Dark mode

Supported by Power Up Privacy

Kicksecure is proudly supported until 2026 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Kicksecure we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint

2012- 2025 ENCRYPTED SUPPORT LLC

Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!