Skip to content
Rocky Linux Community Docs
Rocky Linux
Docs networkNetwork
Search Rocky Linux

    Browse this documentation

    Rocky 10: install systemd-resolved, or skip it?

    Test scope

    Section titled “Test scope”

    Measured on a PVE Rocky Linux 10.2 VM (minimal install). The package came from the Rocky 10.2 DVD BaseOS tree:

    BaseOS/Packages/s/systemd-resolved-257-23.el10_2.1.rocky.0.1.x86_64.rpm

    Install, enable, hand-over and rollback were all exercised. Screenshot: public/evidence/systemd-resolved/rocky-foreign-to-stub.png.

    Default state: no package, DNS still works

    Section titled “Default state: no package, DNS still works”
    $ rpm -q systemd-resolved
    package systemd-resolved is not installed
    

    $ ls -l /etc/resolv.conf
    -rw-r--r--. 1 root root 51 ... /etc/resolv.conf
    $ head -2 /etc/resolv.conf
    # Generated by NetworkManager
    nameserver 223.5.5.5
    

    $ systemctl is-enabled systemd-resolved
    disabled

    In other words: on a minimal install NetworkManager owns DNS and writes a plain file. Nothing listens on port 53. For most servers that is the whole story.

    When it is worth installing

    Section titled “When it is worth installing”
    • per-link DNS (one NIC for internal zones, another for public);
    • a local cache to cut repeated upstream queries;
    • one toolbox for debugging (resolvectl query, resolvectl statistics);
    • systemd-networkd or container-heavy hosts where DNS should follow the link config.

    If you have one NIC, one resolver and only need names to work, adding resolved inserts a hop for no gain.

    Installed is not the same as in use

    Section titled “Installed is not the same as in use”
    # dnf -y --disablerepo=* install /path/to/systemd-resolved-*.rpm
    # systemctl enable --now systemd-resolved
    # resolvectl --no-pager status | grep "resolv.conf mode"
      resolv.conf mode: foreign

    foreign means /etc/resolv.conf was not produced by resolved, so the daemon runs but nothing uses it. This is the step people misread as “it did not work”.

    Hand-over: stop NetworkManager, point the file at the stub

    Section titled “Hand-over: stop NetworkManager, point the file at the stub”
    # cat /etc/NetworkManager/conf.d/90-dns-none.conf
    [main]
    dns=none
    

    # ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
    # systemctl restart NetworkManager systemd-resolved

    Both halves are required: dns=none stops NetworkManager from rewriting the file, and the symlink routes queries into the stub listener.

    Verification:

    $ ls -l /etc/resolv.conf
    /etc/resolv.conf -> /run/systemd/resolve/stub-resolv.conf
    $ resolvectl --no-pager status | grep -E "resolv.conf mode|Current DNS Server"
      resolv.conf mode: stub
        Current DNS Server: 223.5.5.5
    $ ss -lnup | grep ":53 "
    UNCONN ... 127.0.0.54:53 ... ("systemd-resolve")
    UNCONN ... 127.0.0.53%lo:53 ... ("systemd-resolve")

    Rocky Linux 10.2: before and after, foreign to stub

    Rollback in three moves

    Section titled “Rollback in three moves”
    # rm -f /etc/NetworkManager/conf.d/90-dns-none.conf
    # rm -f /etc/resolv.conf
    # systemctl disable --now systemd-resolved
    # systemctl restart NetworkManager

    Deleting the symlink matters more than it looks: with the file absent NetworkManager regenerates it, while a dangling symlink can leave you without any resolver at all.

    Common traps

    Section titled “Common traps”
    • Enabled but not handed over: mode stays foreign and nothing changes;
    • Symlink without dns=none: the next network event overwrites the file, so DNS looks flaky;
    • Half a rollback: resolver disabled while /etc/resolv.conf still points at it breaks resolution entirely;
    • resolvectl query returning No route to host: that is routing, not DNS. Our offline lab hit exactly this — check ip route before blaming the resolver.

    Practice: hand over and roll back safely

    Section titled “Practice: hand over and roll back safely”
    Terminal window
    resolvectl --no-pager status | grep "resolv.conf mode"
    ip route | head -3

    Checks:

    1. Before installing, rpm -q systemd-resolved reports it missing;
    2. After enabling only, mode is still foreign;
    3. After the hand-over, mode is stub and ss -lnup shows 127.0.0.53:53;
    4. Following the rollback steps restores the original state.

    FAQ

    Section titled “FAQ”

    常见问题

    What breaks if I never install it?

    Nothing for a single-NIC, single-resolver host. The benefits appear with per-link DNS, caching, or wanting resolvectl for debugging.

    Does dns=none disable NetworkManager?

    No — it only stops DNS file management. Addresses, routes and connection state are still managed.

    Can one interface use resolved and another not?

    Not with the global dns=none switch; that needs systemd-networkd or per-link configuration.

    Next steps

    Section titled “Next steps”