I have a pi hole in my network and I set it as my primary DNS server, and my router (a Mikrotik) as secondary. DHCP sets the DNS servers as pihole, mikrotik in this exact order and I want to keep it that way. I know systemd-resolved uses some algorithm to set the fastest dns as current server, but I don’t want/need that. Is there some way to do configure it to just let it be?
I’m running Fedora 40.
You must log in or register to comment.
You don’t. There’s a feature request for adding the ability to always try the primary DNS server first but it’s still open.
When you configure multiple DNS servers in systemd-resolved, the resolver will assume all servers are equally valid and produce the same records. This is unlike Windows, which will always try the primary and the randomly try the secondary/tertiary/etc., or dnsmasq which should try the servers in order.
systemd-resolved will rotate through DNS servers, sticking with the one that works when the current server dies. It’s not necessarily about speed, but rather about availability. If all DNS servers fail, it’ll fall back to whatever fallback DNS server was compiled in by your distro (I believe Google’s 8.8.8.8 is compiled in by default but you’ll have to check the Fedora sources to see if they’re configuring systemd for that).
You can install a DNS resolver that does take the “try every server in the list” approach after removing/disabling systemd-resolved. Make sure to update your resolvconf files to point to said server.
However, I do wonder if your Pi-Hole-then-microtik approach actually works on all devices. If your computer validates DNSSEC records, the fake results returned by Pihole will be discarded as broken, and your computer will probably try to resolve the domain on your router, undoing the blocking Pihole is trying to do. You’ll need to disable DNSSEC verification for this approach to work if you’re also including a non-blocking DNS server into the chain.
deleted by creator
You can’t. Well, you shouldn’t rely on queries going out in any particular order. All of your DNS servers should behave the same way as clients may fail from the first one to a secondary.
Why do you care which one is being used? What are you trying to do?
I want to have ads blocked with pihole and at the same time to have local DNS served by the router. I know pihole does local DNS, but RouterOS (mikrotik) is much better suited for that.
If you set the Microtik as Pihole’s upstream server, you should get both Microtik’s local domains and ad blocking.
You may need to disable DNSSEC validation to get it to work if you use a real domain for local records, though.
Thank you. I’ll have it set like this.
deleted by creator
