Been using dnsmasq for ages - mostly for local caching and blocking out dubious domains. Now I have need for split-DNS, so it's time to switch to systemd-resolved.

One major feature I'm using from dnsmasq are the address directives to blacklist domains. I have a daemon script that periodically composes /etc/dnsmasq.d/malware.conf that has a list of rules like


How to replicate this logic using systemd-resolved?

  • Why not just use /etc/hosts?
    – Daniel B
    Jan 17, 2022 at 14:11
  • Needs additional logic to maintain the file - /etc/hosts doesn't allow includes.
    – laur
    Jan 17, 2022 at 14:15
  • Doesn't dnsmasq also support split-dns through server=? Jan 17, 2022 at 14:20
  • @user1686 you're correct, but believe it'd also need additional active management when you have corporate ~DNS~ VPN you may or may not be connected to.
    – laur
    Jan 17, 2022 at 14:21

1 Answer 1


In systemd's world you have systemd.resource-control, a unit settings dedicated to resource control.

by example, you can also apply this in emergency:

systemctl set-property apache2.service IPAddressDeny=

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .