39

I upgraded to Ubuntu 17.04 and it appears to now have a new DNS resolver mechanism first introduced in Ubuntu 16.10.

I am now getting DNS lookup failures 50% of the time. Every other call to nslookup is failing, with half the calls resolving fine and half giving this:

watch -n 1 nslookup google.com

Server:     127.0.0.53
Address:    127.0.0.53#53

** server can't find google.com: SERVFAIL

From what I understand, that DNS server IP address is now used to represent systemd-resolved, which does some kind of meta lookup to avoid slower DNS queries (or something...). I am seeing the exact same behavior on two machines I have upgraded to 17.04 in the past week.

Any idea what the problem is here, and the correct way to address it?

Things were working fine before the upgrade (from 16.04 or 16.10, I don't remember which, sorry). I THOUGHT 17.04 was a LTS release but now I see that I jumped the gun and it won't be considered stable until April. So... here I am.

Also of note... browsers don't seem to exhibit problems, but nslookup, ping, git, etc. do.

Update

In my particular case, my /etc/hosts file was a symlink (as I am a fanatic stow user). Systemd HATES this for some reason, and considers it a "permissions failure". Once I replaced the symlink with the actual file, systemd stopped malfunctioning.

2
  • 2
    Tip for the future: Ubuntu versions are the year it will come out . the month it will be released. (So in your case it will be in 04/17)
    – timotree
    Dec 5, 2016 at 17:18
  • Sounds like systemd-resolved getting crowbarred into distributions is causing other folks trouble too.
    – moodboom
    Dec 8, 2016 at 13:53

6 Answers 6

48

Ubuntu 17.04 can not resolve DNS servers with DNSSEC support as of 2017-04-18. Disable DNSSEC with this daemon:

sudo mkdir -p /etc/systemd/resolved.conf.d
printf "[Resolve]\nDNSSEC=no\n" | sudo tee /etc/systemd/resolved.conf.d/no-dnssec.conf

Optionally reconfigure resolvconf if you messed with it (say yes to "prepare /etc/resolve.conf for dynamic updates?"):

sudo dpkg-reconfigure resolvconf

Restart systemd-resolved:

sudo systemctl restart systemd-resolved

Your DNS should start working. You can check by trying systemd-resolve www.google.com and seeing a response.

8
  • Thank you for the answer- can you explain what it does?
    – bertieb
    Apr 18, 2017 at 10:52
  • Ubuntu 17.04 can not(till here) resolve DNS server with DNSSEC support. I disable DNSSEC with this daemon. Apr 18, 2017 at 11:08
  • Thanks, can you edit that explanation into your answer? :)
    – bertieb
    Apr 18, 2017 at 11:25
  • This solution did not work for me - after setting this, still anytime I do a lookup the first time, I get a SERVFAIL error, after a couple of tries it succeeds and then the result is cached.
    – Guss
    May 11, 2017 at 12:38
  • 1
    @SamuelL. regarding tee, it's just a fancy way to print something and send it to a file at the same time. Typically you can redirect output to a file with > [the greater-than character], but then you won't see the output. Tee lets it go to both places. Resolvconf "configures resolve".
    – moodboom
    Sep 5, 2017 at 17:23
13

I've been switching back and forth between systemd-resolved and manual /etc/resolv.conf management and have not found the systemd DNS resolver mechanism to be stable yet.

There is apparently at least one libnss bug in Ubuntu 16.10 and apparently still in 17.04. There are many people with DNS issues since Ubuntu 16.10 turned on systemd-resolved, here is one analysis and here is another person's workaround. None of them worked for me until I manually overwrote /etc/resolv.conf with google's DNS servers.

nameserver 8.8.8.8   << or another if you don't trust google
nameserver 8.8.4.4

This is a perfectly valid solution, if you don't need dynamic DNS configuration. Just make sure you stop and disable systemd-resolved:

sudo systemctl disable systemd-resolved.service
sudo service systemd-resolved stop
4
  • Changing to resolveconf did not help my issue, how do I go back to using systemd-resolved? (Thanks) Jul 17, 2017 at 14:49
  • 1
    Try: systemctl enable systemd-resolved.service && systemctl start systemd-resolved.service
    – moodboom
    Jul 17, 2017 at 15:20
  • 1
    Dude, you just saved ma system !! BRAVO Jan 24, 2018 at 23:54
  • Worked fine in 18.04 Jan 31, 2019 at 12:49
4

Ubuntu 17.04 and other distros are embracing systemd, which includes systemd-resolved, which subjects users to a rather heavy-handed DNS resolution.

  • As mentioned in SjB answer, DNSSEC support can cause issues.
  • systemd-resolved pings all DNS resolvers so it can use the fastest. This can cause problems with VPNs etc in more complex environments.
  • DNS server certificates are verified, I've had errors if my clock is skewed.

I don't think it's necessarily a BAD change, it's just a LOT of change. I'll try to update and expand this answer as I learn more.

4

Put simply you just need to have the line "DNSSEC=no" in the [Resolve] section of /etc/systemd/resolved.conf.

https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1682499/

1
  • Thanks for the bugfix link. The default will be changed back to DNSSEC=no in upcoming update releases, which will make that particular issue go away.
    – moodboom
    Sep 6, 2017 at 14:31
1

just add name server /etc/systemd/resolved.conf DNS=194.109.xxx.xxx (on your router, external nameserver)

systemctl restart systemd-resolved

no need to change rand from 3 to 2, no need to change dnssec setting to off

2
  • Unfortunately this alone doesn't solve the "every-other-request-fails" problem for me.
    – moodboom
    Dec 18, 2017 at 15:49
  • Agree with @moodboom, this doesn't solve to me also. Jan 31, 2019 at 12:33
0

I finally determined the source of my specific problem with systemd-resolved. /etc/hosts was a symlink, as I use stow for my dot files. Well... systemd refuses to look at it, giving a "permissions error" (sic). Once I replaced my symlink with a full copy of my /etc/hosts file, systemd was happy again.

Yet another reason to distrust the huge mess that is systemd, IMHO. But we can't go backwards. Full steam ahead.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .