Re: systemd-resolved : How to change permanently to 127.0.0.54

["Kevin P. Fleming" <lists.systemd-devel@xxxxxxxxxxxxx>]

On Mon, Dec 23, 2024, at 09:09, Laura Smith wrote:
> Sent with Proton Mail secure email.
>
> On Monday, 23 December 2024 at 14:00, Kevin P. Fleming 
> <lists.systemd-devel@xxxxxxxxxxxxx> wrote:
>
>> The simplest fix is to set "DNSSEC=no" 
>
> That seems to me to be a bit of a "sledgehammer to crack a nut".
>
> The man page for resolved.conf says:
>
> "It is recommended to set DNSSEC= to true on systems where it is known 
> that the DNS server supports DNSSEC correctly "
>
> I know that my DNS servers do, since they are all modern 
> implementations which have no issues with DNSSEC support.
>
> Also DNSSEC=no would also kill DANE which is not a desirable outcome ?

Yes, it would. The statement you read above is based on an assumption by the authors of systemd-resolved that it will never interfere with DNSSEC validation, but there is ample evidence that that statement is not true (although it has gotten quite a bit better in the most recent releases, but unless you are using a bleeding-edge distribution you won't have those releases).

If you are only going to use systemd-resolved in proxy mode, with a fixed set of upstream resolvers, then I think the best solution is to just remove systemd-resolved from the path completely and put those upstream resolvers directly into /etc/resolv.conf. It's not going to provide you much, if any, value, if it's not doing caching or DNSSEC validation.