RESOLVED.CONF

NAME
SYNOPSIS
æè¿°
éç½®ç®å½åå¶ä¼å级
é项
åè§
NOTES
è·

---

NAME

resolved.conf, resolved.conf.d - ç½ç»åå解ææå¡éç½®æ件

SYNOPSIS

/etc/systemd/resolved.conf

/etc/systemd/resolved.conf.d/*.conf

/run/systemd/resolved.conf.d/*.conf

/usr/lib/systemd/resolved.conf.d/*.conf

æè¿°

è¿äºéç½®æ件æ§å¶çæ¬å°DNSä¸LLMNRåå解æ

éç½®ç®å½åå¶ä¼å级

é»è®¤è®¾ç½®æ¯å¨ç¼è¯æé´ç¡®å®çï¼ æ以ä»å¨ç¡®å®éè¦ä¿®æ¹é»è®¤è®¾ç½®çæåµä¸ï¼ æéè¦ä½¿ç¨éç½®æ件ãä½äº /etc/systemd/ ç®å½ä¸çåå§éç½®æä»¶ï¼ ä»åå«äºå±ç¤ºé项é»è®¤å¼ç注éï¼ ç®çå¨äºæ¹ä¾¿ç³»ç»ç®¡çåæ¥çåç´æ¥ä¿®æ¹ã

å¦æ软件åæ³è¦èªå®ä¹æäºé»è®¤è®¾ç½®ï¼ é£ä¹å¿é¡»å°èªå®ä¹çéç½®æ件å®è£å° /usr/lib/systemd/*.conf.d/ ç®å½ä¸ã /etc/ ç®å½ä»ä¾ç³»ç»ç®¡çå使ç¨ã ç³»ç»ç®¡çåå¯ä»¥å©ç¨ä¸é¢çé»è¾æ¥è¦çé»è®¤è®¾ç½®ï¼ 主éç½®æ件æå被读åï¼ ä¼å级ä¹æä½ã ææ *.conf.d/ ä¸çéç½®æ件 é½ä¼è¦ç主éç½®æ件ä¸ç设置ã ææ *.conf.d/ ä¸çéç½®æ件(æ è®ºä½äºåªä¸ªç®å½ä¸)ï¼ ç»ä¸æç§æ件åçåå¸é¡ºåºå¤çã å¦æå¨å¤ä¸ªéç½®æ件ä¸è®¾ç½®äºåä¸ä¸ªéé¡¹ï¼ é£ä¹ä»ä»¥æ件åæé å(å- å¸é¡ºåº)çé£ä¸ä¸ªä¸ºåã 为äºä¾¿äºæåºï¼ 建议ç»ææ *.conf.d/ ä¸çéç½®æ件 é½å ä¸ä¸¤ä½åè¿å¶æ°åçæ件ååç¼ã

å¦æç³»ç»ç®¡çåæ³è¦å±è½ /usr/lib/ ç®å½ä¸çæ个éç½®æä»¶ï¼ é£ä¹æä½³åæ³æ¯å¨ /etc/ ç®å½ä¸ å建ä¸ä¸ªæå /dev/null çåå符å·é¾æ¥ï¼ å³å¯å½»åºå±è½ /usr/lib/ ç®å½ä¸çååæ件ã

é项

ä¸åé项é½ä½äº "[Resolve]" å°èï¼

DNS=

ä¸ä¸ªç©ºæ ¼åéç IPv4 ä¸ IPv6 å°åå表ãç¨ä½ç³»ç»çå¨å±DNSæå¡å¨ã DNS请æ±å°è¢«é¦ååéç» systemd-networkd.service(8) ä¸- é对ç¹å®è¿æ¥è®¾ç½®çDNSæå¡å¨æèç±å¤é¨ç¨åºå¨è¿è¡æ¶è®¾ç½®çDNSæå¡å¨ï¼ç¶åæä¼åéç»æ- ¤å¤è®¾ç½®çå¨å±DNSæå¡å¨ã åºäºå¼å®¹æ§èèï¼å¦ææªè®¾ç½®æ- ¤é项ï¼é£ä¹å°ä½¿ç¨ /etc/resolv.conf ä¸çDNSæå¡å¨(å¦æå¶ä¸- ç¡®å®éç½®äºDNSæå¡å¨çè¯)ã æ¤é项çé»è®¤å¼ä¸ºç©ºã

FallbackDNS=

ä¸ä¸ªç©ºæ ¼åéç IPv4 ä¸ IPv6 å°åå表ãç¨ä½ç³»ç»çæ¿è¡¥DNSæå¡å¨ã å¨ systemd-networkd.service(8) ä¸ é对ç¹å®è¿æ¥éç½®çä»»ä½DNSæå¡å¨çä¼å级é½é«äºæ¤é项ä¸- 设置çDNSæå¡å¨ï¼ ä¹é«äºä¸è¿° DNS= ä¸è®¾ç½®çDNSæå¡å¨ï¼åæ ·ä¹é«äº /etc/resolv.conf ä¸è®¾ç½®çDNSæå¡å¨ã æ以ï¼æ- ¤é项æ设置çDNSæå¡å¨ä»å¨å®å¨æ¾ä¸å°å¯ç¨DNSçæåµä¸æä¼è¢«ä½¿ç¨ã è¥æªè®¾ç½®æ¤é项ï¼å使ç¨ç¨åºåç½®çé»è®¤DNSæå¡å¨å表ã

Domains=

ä¸ä¸ªç©ºæ ¼åéçååå表ã å¨è§£æä¸å«"."çååæ¶ï¼å°è¢«ç¨ä½åååç¼ï¼ä»¥å°è¿äºåå转å为FQDN(å¨éå®åå)ã è¿äºåç¼å°ä¼ä¸¥æ ¼æç§è¿é设置ç顺åºä¾æ¬¡å°è¯ï¼ç´å°è§£ææåã åºäºå¼å®¹æ§èèï¼å¦ææªè®¾ç½®æ¤éé¡¹ï¼ é£ä¹å°ä½¿ç¨ /etc/resolv.conf ä¸- ååºçæç´¢å(å¦æå¶ä¸ç¡®å®éç½®äºæç´¢åçè¯)ã æ¤é项çé»è®¤å¼ä¸ºç©ºã

å¦ææå®çåå带æ "˜" åç¼ï¼ é£ä¹è¡¨ç¤ºå®ä¸æ¯ä¸ä¸ªæç´¢åï¼èæ¯ä¸ä¸ª"è·¯ç±ä¸ç¨åå"ï¼ä¹å°±æ¯ä»ç¨äºå°æå®çååæ¥è¯¢è¯·æ± ä¼åè·¯ç±å°ä¸æ DNS= 设置çå¨å±DNSæå¡å¨ä¸å»ã 注æï¼å¦æä¸å- å¨é对ç¹å®è¿æ¥çDNSæå¡å¨ï¼é£ä¹ "˜" è¯æ³æ²¡æä»»ä½å®éææã ç¹æ®å¼ "˜." 表示å°ææDNSæ¥è¯¢è¯·æ± ä¼åè·¯ç±å°ä¸æ DNS= 设置çå¨å±DNSæå¡å¨ä¸å» (åé¢ç波浪å·è¡¨ç¤ºè¿æ¯ä¸ä¸ª"è·¯ç±ä¸ç¨åå"ï¼åé¢çç¹è¡¨ç¤ºDNSæ ¹åå(ä¹å°±æ¯ææååçåç¼))ã

LLMNR=

å¿é¡»è®¾ä¸º "resolve" æå¸å°å¼ã æ§å¶æ¬æºå¯¹LLMNR(Link-Local Multicast Name Resolution, RFC 4794 [1] )çæ¯æã 设为 yes 表示å®å¨æ¯æ LLMNR responder ä¸ resolver ï¼ è®¾ä¸º no 表示彻åºä¸æ¯æ LLMNR ï¼ è®¾ä¸º "resolve" 表示ä»æ¯æ LLMNR resolver èä¸æ¯æ LLMNR responder ï¼ æ³¨æï¼ systemd-networkd.service(8) ä¸è¿æé对ç¹å®è¿æ¥çLLMNR设置ã 对äºæ个ç¹å®çè¿æ¥æ¥è¯´ï¼LLMNR å°ä»å¨é对该è¿æ¥ç设置ä¸å¨å±è®¾ç½®é½å¼å¯çæåµä¸ï¼æä¼å¼å¯ã

DNSSEC=

å¿é¡»è®¾ä¸ºå¸å°å¼æç¹æ®å¼ "allow-downgrade" ã 设为 yes è¡¨ç¤ºä½¿ç¨ DNSSEC æºå¶æ£æ¥ææ DNS åºççæææ§(å¤æDNS ä¸ LLMNR é¤å¤)ã å¦ææ个DNSåºç被é´å®ä¸ºæ æï¼ é£ä¹ä¸å±åºç¨å°ä¼å¾å°ä¸ä¸ª"æ¥è¯¢å¤±è´¥"çç»æã 注æï¼è¿æå³ç DNS æå¡å¨å¿é¡»æ¯æ DNSSEC ã å¦ææ个 DNS æå¡å¨ä¸è½æ£ç¡®æ¯æ DNSSEC ï¼ é£ä¹ä»è¯¥ DNS æå¡å¨æ¥æ¶å°çææåºçé½å°è¢«è§ä¸ºæ æåºçã 设为 "allow-downgrade" è¡¨ç¤ºï¼ å¦ææ个 DNS æå¡å¨ä¸è½æ£ç¡®æ¯æ DNSSEC ï¼ é£ä¹å°ä¸ä½¿ç¨ DNSSEC æºå¶æ£æ¥è¯¥ DNS åºççæææ§ã 注æï¼è¿å°å¯¼è´ DNSSEC æºå¶å½¢åè设ï¼ä»èé æå®å¨æ¼æ´ã 设为 no å表示彻åºç¦ç¨ DNSSEC æºå¶ã

注æï¼å ä¸º DNSSEC éè¦é¢å¤æ¥è¯¢æ´å¤çDNSæ°æ®ï¼ æ以ï¼å¼å¯æ- ¤é项ä¼åæ¢DNSæ¥è¯¢é度ã

DNSSEC requires knowledge of "trust anchors" to prove data integrity. The trust anchor for the Internet root domain is built into the resolver, additional trust anchors may be defined with dnssec-trust-anchors.d(5). Trust anchors may change at regular intervals, and old trust anchors may be revoked. In such a case DNSSEC validation is not possible until new trust anchors are configured locally or the resolver software package is updated with the new root trust anchor. In effect, when the built-in trust anchor is revoked and DNSSEC= is yes, all further lookups will fail, as it cannot be proved anymore whether lookups are correctly signed, or validly unsigned. If DNSSEC= is set to "allow-downgrade" the resolver will automatically turn off DNSSEC validation in such a case.

Client programs looking up DNS data will be informed whether lookups could be verified using DNSSEC, or whether the returned data could not be verified (either because the data was found unsigned in the DNS, or the DNS server did not support DNSSEC or no appropriate trust anchors were known). In the latter case it is assumed that client programs employ a secondary scheme to validate the returned DNS data, should this be required.

It is recommended to set DNSSEC= to yes on systems where it is known that the DNS server supports DNSSEC correctly, and where software or trust anchor updates happen regularly. On other systems it is recommended to set DNSSEC= to "allow-downgrade".

In addition to this global DNSSEC setting systemd-networkd.service(8) also maintains per-link DNSSEC settings. For system DNS servers (see above), only the global DNSSEC setting is in effect. For per-link DNS servers the per-link setting is in effect, unless it is unset in which case the global setting is used instead.

Site-private DNS zones generally conflict with DNSSEC operation, unless a negative (if the private zone is not signed) or positive (if the private zone is signed) trust anchor is configured for them. If "allow-downgrade" mode is selected, it is attempted to detect site-private DNS zones using top-level domains (TLDs) that are not known by the DNS root server. This logic does not work in all private zone setups.

é»è®¤å¼æ¯ no

Cache=

å¿é¡»è®¾ä¸ºå¸å°å¼ã é»è®¤å¼ "yes" 表示ç¼åååå·²ç»è§£ææåçååç´å°ç¼å- è¿æï¼ä»¥é¿åéå¤æ¥è¯¢ã 注æï¼å³éç¼å- ä¸ä½æµªè´¹ç½ç»æµéï¼æ´å®¹æé æ访é®å»¶è¿ï¼å°¤å¶æ¯å¨ä½¿ç¨äºDNSSECçæ¶åã

注æï¼å¯¹äºIPå°å为 127.0.0.1 æ ::1 ä¹ç±»çæ¬æºDNSæ¥è¯´ï¼DNSç¼å- æ»æ¯å³éçã è¿æ ·åæ¯ä¸ºäºé¿åä¸å¿è¦çå¤æ¬¡ç¼åã

åè§

systemd(1), systemd-resolved.service(8), systemd-networkd.service(8), dnssec-trust-anchors.d(5), resolv.conf(4)

NOTES

1.

RFC 4794

https://tools.ietf.org/html/rfc4795

è·

æ¬é¡µé¢ä¸æçç±ä¸æ man æå页计åæä¾ã

ç¿»è¯äººåï¼éæ¥å½
éæ¥å½ä½åéï¼http://www.jinbuguo.com
ä¸æ man æå页计åï¼https://github.com/man-pages-zh/manpages-zh

---