Taming the DNS Resolver: Getting resolvectl to Play Nice with Your Home Network

Introduction to resolvectl

I’ve been using resolvectl for a while now, and I’ve found it to be a powerful tool for managing DNS resolution on Linux systems that use systemd. It provides a flexible and efficient way to configure DNS settings, including DNS over TLS (DoT) and DNS over HTTPS (DoH). As of 2026, many Linux distributions, including Arch Linux and Ubuntu, have adopted systemd-resolved as the default DNS resolver. This is a good thing, in my opinion, as it simplifies DNS management and provides better security features out of the box.

Configuring resolvectl for Home Networks

To get started with resolvectl, you’ll need to ensure that systemd-resolved is installed and running on your system. On most distributions, this is the default setup. You can verify the status of the service using the following command:

systemctl status systemd-resolved

If the service is not running, you can start it with:

sudo systemctl start systemd-resolved

Don’t bother with enabling the service to start at boot unless you’re sure you need it - most distributions will handle this for you. To configure resolvectl for your home network, you’ll need to specify the DNS servers you want to use. You can do this using the resolvectl command with the status option:

resolvectl status

This will display the current DNS configuration, including the DNS servers being used. The real trick is to use the resolvectl command with the dns option to add a new DNS server:

resolvectl dns <interface> <dns_server>

Replace <interface> with the name of your network interface (e.g., eth0 or wlan0) and <dns_server> with the IP address of the DNS server you want to use. I usually start with a simple configuration and then add more complex settings as needed.

Using DNS over TLS (DoT) with resolvectl

To enable DNS over TLS (DoT) with resolvectl, you’ll need to specify the DoT server you want to use. You can do this using the resolvectl command with the dns option and the + symbol to indicate a DoT server:

resolvectl dns <interface> +<dot_server>

Replace <dot_server> with the IP address or hostname of the DoT server you want to use. For example:

resolvectl dns eth0 +1.1.1.1

This will configure resolvectl to use Cloudflare’s DoT server. In practice, I’ve found that using DoT provides a good balance between security and performance.

Troubleshooting resolvectl Issues

If you encounter issues with resolvectl, you can use the resolvectl command with the log option to view the log output:

resolvectl log

This will display the log output for the systemd-resolved service, which can help you diagnose issues with DNS resolution. This is where people usually get burned - they forget to check the logs and end up spending hours debugging a simple issue.

Security Considerations

When using resolvectl, it’s essential to consider the security implications of your DNS configuration. Using DNS over TLS (DoT) or DNS over HTTPS (DoH) can help protect your DNS traffic from interception and eavesdropping. However, it’s also important to ensure that your DNS servers are trustworthy and configured correctly. I’ve seen this go wrong when people use untrusted DNS servers - it’s a recipe for disaster.

Additional Resources

For more information on resolvectl and systemd-resolved, you can visit the systemd.io website, which provides detailed documentation on the systemd ecosystem. Additionally, the freedesktop.org website provides information on the systemd-resolved project and its goals. These resources are invaluable for anyone looking to learn more about resolvectl and how to use it effectively.