I upgraded to Ubuntu 17.04 and it appears to now have a new DNS resolver mechanism first introduced in Ubuntu 16.10.

I am now getting DNS lookup failures 50% of the time. Every other call to nslookup is failing, with half the calls resolving fine and half giving this:

watch -n 1 nslookup google.com

Server:     127.0.0.53
Address:    127.0.0.53#53

** server can't find google.com: SERVFAIL

From what I understand, that DNS server IP address is now used to represent systemd-resolved, which does some kind of meta lookup to avoid slower DNS queries (or something...). I am seeing the exact same behavior on two machines I have upgraded to 17.04 in the past week.

Any idea what the problem is here, and the correct way to address it?

Things were working fine before the upgrade (from 16.04 or 16.10, I don't remember which, sorry). I THOUGHT 17.04 was a LTS release but now I see that I jumped the gun and it won't be considered stable until April. So... here I am.

Also of note... browsers don't seem to exhibit problems, but nslookup, ping, git, etc. do.

  • 2
    Tip for the future: Ubuntu versions are the year it will come out . the month it will be released. (So in your case it will be in 04/17) – timotree Dec 5 '16 at 17:18
  • Light bulb, on. :-) thanks. – moodboom Dec 5 '16 at 17:44
  • Sounds like systemd-resolved getting crowbarred into distributions is causing other folks trouble too. – moodboom Dec 8 '16 at 13:53
up vote 42 down vote accepted

Ubuntu 17.04 can not resolve DNS servers with DNSSEC support as of 2017-04-18. Disable DNSSEC with this daemon:

sudo mkdir -p /etc/systemd/resolved.conf.d
printf "[Resolve]\nDNSSEC=no\n" | sudo tee /etc/systemd/resolved.conf.d/no-dnssec.conf

Optionally reconfigure resolvconf if you messed with it (say yes to "prepare /etc/resolve.conf for dynamic updates?"):

sudo dpkg-reconfigure resolvconf

Restart systemd-resolved:

sudo systemctl restart systemd-resolved

Your DNS should start working. You can check by trying systemd-resolve www.google.com and seeing a response.

  • Thank you for the answer- can you explain what it does? – bertieb Apr 18 '17 at 10:52
  • Ubuntu 17.04 can not(till here) resolve DNS server with DNSSEC support. I disable DNSSEC with this daemon. – Sajad Bahmani Apr 18 '17 at 11:08
  • Thanks, can you edit that explanation into your answer? :) – bertieb Apr 18 '17 at 11:25
  • This solution did not work for me - after setting this, still anytime I do a lookup the first time, I get a SERVFAIL error, after a couple of tries it succeeds and then the result is cached. – Guss May 11 '17 at 12:38
  • 1
    @SamuelL. regarding tee, it's just a fancy way to print something and send it to a file at the same time. Typically you can redirect output to a file with > [the greater-than character], but then you won't see the output. Tee lets it go to both places. Resolvconf "configures resolve". – moodboom Sep 5 '17 at 17:23

I've been switching back and forth between systemd-resolved and manual /etc/resolv.conf management and have not found the systemd DNS resolver mechanism to be stable yet.

There is apparently at least one libnss bug in Ubuntu 16.10 and apparently still in 17.04. There are many people with DNS issues since Ubuntu 16.10 turned on systemd-resolved, here is one analysis and here is another person's workaround. None of them worked for me until I manually overwrote /etc/resolv.conf with google's DNS servers.

nameserver 8.8.8.8   << or another if you don't trust google
nameserver 8.8.4.4

This is a perfectly valid solution, if you don't need dynamic DNS configuration. Just make sure you stop and disable systemd-resolved:

sudo systemctl disable systemd-resolved.service
sudo service systemd-resolved stop
  • Changing to resolveconf did not help my issue, how do I go back to using systemd-resolved? (Thanks) – Edward Moffett Jul 17 '17 at 14:49
  • 1
    Try: systemctl enable systemd-resolved.service && systemctl start systemd-resolved.service – moodboom Jul 17 '17 at 15:20
  • 1
    Dude, you just saved ma system !! BRAVO – revolutionary Jan 24 at 23:54

Ubuntu 17.04 and other distros are embracing systemd, which includes systemd-resolved, which subjects users to a rather heavy-handed DNS resolution.

  • As mentioned in SjB answer, DNSSEC support can cause issues.
  • systemd-resolved pings all DNS resolvers so it can use the fastest. This can cause problems with VPNs etc in more complex environments.
  • DNS server certificates are verified, I've had errors if my clock is skewed.

I don't think it's necessarily a BAD change, it's just a LOT of change. I'll try to update and expand this answer as I learn more.

Put simply you just need to have the line "DNSSEC=no" in the [Resolve] section of /etc/systemd/resolved.conf.

https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1682499/

  • Thanks for the bugfix link. The default will be changed back to DNSSEC=no in upcoming update releases, which will make that particular issue go away. – moodboom Sep 6 '17 at 14:31

just add name server /etc/systemd/resolved.conf DNS=194.109.xxx.xxx (on your router, external nameserver)

systenctl restart systemd-resolved

no need to change rand from 3 to 2 no need to change dnssec to off

  • Unfortunately this alone doesn't solve the "every-other-request-fails" problem for me. – moodboom Dec 18 '17 at 15:49

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.