I have a pi hole in my network and I set it as my primary DNS server, and my router (a Mikrotik) as secondary. DHCP sets the DNS servers as pihole, mikrotik in this exact order and I want to keep it that way. I know systemd-resolved uses some algorithm to set the fastest dns as current server, but I don’t want/need that. Is there some way to do configure it to just let it be?
I’m running Fedora 40.
You must log in or register to comment.
i think you should just set the pi, then have the pi configured to internally use the other for things it doesn’t block.
You can’t. Well, you shouldn’t rely on queries going out in any particular order. All of your DNS servers should behave the same way as clients may fail from the first one to a secondary.
Why do you care which one is being used? What are you trying to do?
I want to have ads blocked with pihole and at the same time to have local DNS served by the router. I know pihole does local DNS, but RouterOS (mikrotik) is much better suited for that.
If you set the Microtik as Pihole’s upstream server, you should get both Microtik’s local domains and ad blocking.
You may need to disable DNSSEC validation to get it to work if you use a real domain for local records, though.
You don’t. There’s a feature request for adding the ability to always try the primary DNS server first but it’s still open.
When you configure multiple DNS servers in systemd-resolved, the resolver will assume all servers are equally valid and produce the same records. This is unlike Windows, which will always try the primary and the randomly try the secondary/tertiary/etc., or dnsmasq which should try the servers in order.
systemd-resolved will rotate through DNS servers, sticking with the one that works when the current server dies. It’s not necessarily about speed, but rather about availability. If all DNS servers fail, it’ll fall back to whatever fallback DNS server was compiled in by your distro (I believe Google’s 8.8.8.8 is compiled in by default but you’ll have to check the Fedora sources to see if they’re configuring systemd for that).
You can install a DNS resolver that does take the “try every server in the list” approach after removing/disabling systemd-resolved. Make sure to update your resolvconf files to point to said server.
However, I do wonder if your Pi-Hole-then-microtik approach actually works on all devices. If your computer validates DNSSEC records, the fake results returned by Pihole will be discarded as broken, and your computer will probably try to resolve the domain on your router, undoing the blocking Pihole is trying to do. You’ll need to disable DNSSEC verification for this approach to work if you’re also including a non-blocking DNS server into the chain.
Via ChatGPT 4 (accuracy unverified):
Yes, you can configure
systemd-resolvedto use the DNS servers in the order provided without dynamically switching based on speed. Here’s how you can do it:-
Edit the resolved configuration file:
Open the
resolved.conffile in a text editor:sudo nano /etc/systemd/resolved.conf -
Modify or add the following line:
DNS=`IP_of_pihole` `IP_of_mikrotik` DNSStubListener=no FallbackDNS=Replace
IP_of_piholeandIP_of_mikrotikwith your actual DNS IP addresses. This tellssystemd-resolvedto only use the DNS servers in the order you’ve specified. -
Prevent automatic DNS changes by network manager:
If you’re using NetworkManager, create a drop-in configuration to prevent it from overriding DNS settings:
sudo mkdir -p /etc/NetworkManager/conf.d/ sudo nano /etc/NetworkManager/conf.d/dns.confAdd the following content:
[main] dns=none -
Restart services:
After making these changes, restart
systemd-resolvedandNetworkManager:sudo systemctl restart systemd-resolved sudo systemctl restart NetworkManager
This should ensure that your system uses the DNS servers in the order provided without any automatic switching.
-
