| <?xml version='1.0'?> |
| <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" |
| "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"> |
| <!-- SPDX-License-Identifier: LGPL-2.1-or-later --> |
| |
| <refentry id="resolvectl" conditional='ENABLE_RESOLVE' |
| xmlns:xi="http://www.w3.org/2001/XInclude"> |
| |
| <refentryinfo> |
| <title>resolvectl</title> |
| <productname>systemd</productname> |
| </refentryinfo> |
| |
| <refmeta> |
| <refentrytitle>resolvectl</refentrytitle> |
| <manvolnum>1</manvolnum> |
| </refmeta> |
| |
| <refnamediv> |
| <refname>resolvectl</refname> |
| <refname>resolvconf</refname> |
| <refpurpose>Resolve domain names, IPV4 and IPv6 addresses, DNS resource records, and services; introspect and reconfigure the DNS resolver</refpurpose> |
| </refnamediv> |
| |
| <refsynopsisdiv> |
| <cmdsynopsis> |
| <command>resolvectl</command> |
| <arg choice="opt" rep="repeat">OPTIONS</arg> |
| <arg choice="req">COMMAND</arg> |
| <arg choice="opt" rep="repeat">NAME</arg> |
| </cmdsynopsis> |
| </refsynopsisdiv> |
| |
| <refsect1> |
| <title>Description</title> |
| |
| <para><command>resolvectl</command> may be used to resolve domain names, IPv4 and IPv6 addresses, DNS resource |
| records and services with the |
| <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry> |
| resolver service. By default, the specified list of parameters will be resolved as hostnames, retrieving their IPv4 |
| and IPv6 addresses. If the parameters specified are formatted as IPv4 or IPv6 operation the reverse operation is |
| done, and a hostname is retrieved for the specified addresses.</para> |
| |
| <para>The program's output contains information about the protocol used for the look-up and on which network |
| interface the data was discovered. It also contains information on whether the information could be |
| authenticated. All data for which local DNSSEC validation succeeds is considered authenticated. Moreover all data |
| originating from local, trusted sources is also reported authenticated, including resolution of the local host |
| name, the <literal>localhost</literal> hostname or all data from <filename>/etc/hosts</filename>.</para> |
| </refsect1> |
| |
| <refsect1> |
| <title>Commands</title> |
| <variablelist> |
| |
| <varlistentry> |
| <term><command>query</command> <replaceable>HOSTNAME|ADDRESS</replaceable>…</term> |
| |
| <listitem><para>Resolve domain names, IPv4 and IPv6 addresses.</para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><command>service</command> |
| [[<replaceable>NAME</replaceable>] <replaceable>TYPE</replaceable>] |
| <replaceable>DOMAIN</replaceable></term> |
| |
| <listitem><para>Resolve <ulink url="https://tools.ietf.org/html/rfc6763">DNS-SD</ulink> and |
| <ulink url="https://tools.ietf.org/html/rfc2782">SRV</ulink> services, depending on the specified list of parameters. |
| If three parameters are passed the first is assumed to be the DNS-SD service name, the second the SRV service type, |
| and the third the domain to search in. In this case a full DNS-SD style SRV and TXT lookup is executed. If only two |
| parameters are specified, the first is assumed to be the SRV service type, and the second the domain to look in. In |
| this case no TXT RR is requested. Finally, if only one parameter is specified, it is assumed to be a domain name, |
| that is already prefixed with an SRV type, and an SRV lookup is done (no TXT).</para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><command>openpgp</command> <replaceable>EMAIL@DOMAIN</replaceable>…</term> |
| |
| <listitem><para>Query PGP keys stored as <ulink url="https://tools.ietf.org/html/rfc7929">OPENPGPKEY</ulink> |
| resource records. Specified e-mail addresses are converted to the corresponding DNS domain name, and any |
| OPENPGPKEY keys are printed.</para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><command>tlsa</command> |
| [<replaceable>FAMILY</replaceable>] |
| <replaceable>DOMAIN</replaceable>[:<replaceable>PORT</replaceable>]…</term> |
| |
| <listitem><para>Query TLS public keys stored as <ulink url="https://tools.ietf.org/html/rfc6698">TLSA</ulink> |
| resource records. A query will be performed for each of the specified names prefixed with the port and family |
| (<literal>_<replaceable>port</replaceable>._<replaceable>family</replaceable>.<replaceable>domain</replaceable></literal>). |
| The port number may be specified after a colon (<literal>:</literal>), otherwise <constant>443</constant> will be used |
| by default. The family may be specified as the first argument, otherwise <constant>tcp</constant> will be used.</para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><command>status</command> [<replaceable>LINK</replaceable>…]</term> |
| |
| <listitem><para>Shows the global and per-link DNS settings currently in effect. If no command is specified, |
| this is the implied default.</para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><command>statistics</command></term> |
| |
| <listitem><para>Shows general resolver statistics, including information whether DNSSEC is |
| enabled and available, as well as resolution and validation statistics.</para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><command>reset-statistics</command></term> |
| |
| <listitem><para>Resets the statistics counters shown in <command>statistics</command> to zero. |
| This operation requires root privileges.</para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><command>flush-caches</command></term> |
| |
| <listitem><para>Flushes all DNS resource record caches the service maintains locally. This is mostly equivalent |
| to sending the <constant>SIGUSR2</constant> to the <command>systemd-resolved</command> |
| service.</para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><command>reset-server-features</command></term> |
| |
| <listitem><para>Flushes all feature level information the resolver learnt about specific servers, and ensures |
| that the server feature probing logic is started from the beginning with the next look-up request. This is |
| mostly equivalent to sending the <constant>SIGRTMIN+1</constant> to the <command>systemd-resolved</command> |
| service.</para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><command>dns</command> [<replaceable>LINK</replaceable> [<replaceable>SERVER</replaceable>…]]</term> |
| <term><command>domain</command> [<replaceable>LINK</replaceable> [<replaceable>DOMAIN</replaceable>…]]</term> |
| <term><command>default-route</command> [<replaceable>LINK</replaceable> [<replaceable>BOOL</replaceable>…]]</term> |
| <term><command>llmnr</command> [<replaceable>LINK</replaceable> [<replaceable>MODE</replaceable>]]</term> |
| <term><command>mdns</command> [<replaceable>LINK</replaceable> [<replaceable>MODE</replaceable>]]</term> |
| <term><command>dnssec</command> [<replaceable>LINK</replaceable> [<replaceable>MODE</replaceable>]]</term> |
| <term><command>dnsovertls</command> [<replaceable>LINK</replaceable> [<replaceable>MODE</replaceable>]]</term> |
| <term><command>nta</command> [<replaceable>LINK</replaceable> [<replaceable>DOMAIN</replaceable>…]]</term> |
| |
| <listitem> |
| <para>Get/set per-interface DNS configuration. These commands may be used to configure various DNS |
| settings for network interfaces. These commands may be used to inform |
| <command>systemd-resolved</command> or <command>systemd-networkd</command> about per-interface DNS |
| configuration determined through external means. The <command>dns</command> command expects IPv4 or |
| IPv6 address specifications of DNS servers to use. Each address can optionally take a port number |
| separated with <literal>:</literal>, a network interface name or index separated with |
| <literal>%</literal>, and a Server Name Indication (SNI) separated with <literal>#</literal>. When |
| IPv6 address is specified with a port number, then the address must be in the square brackets. That |
| is, the acceptable full formats are <literal>111.222.333.444:9953%ifname#example.com</literal> for |
| IPv4 and <literal>[1111:2222::3333]:9953%ifname#example.com</literal> for IPv6. The |
| <command>domain</command> command expects valid DNS domains, possibly prefixed with |
| <literal>~</literal>, and configures a per-interface search or route-only domain. The |
| <command>default-route</command> command expects a boolean parameter, and configures whether the |
| link may be used as default route for DNS lookups, i.e. if it is suitable for lookups on domains no |
| other link explicitly is configured for. The <command>llmnr</command>, <command>mdns</command>, |
| <command>dnssec</command> and <command>dnsovertls</command> commands may be used to configure the |
| per-interface LLMNR, MulticastDNS, DNSSEC and DNSOverTLS settings. Finally, <command>nta</command> |
| command may be used to configure additional per-interface DNSSEC NTA domains.</para> |
| |
| <para>Commands <command>dns</command>, <command>domain</command> and <command>nta</command> can take |
| a single empty string argument to clear their respective value lists.</para> |
| |
| <para>For details about these settings, their possible values and their effect, see the |
| corresponding settings in |
| <citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para> |
| </listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><command>revert <replaceable>LINK</replaceable></command></term> |
| |
| <listitem><para>Revert the per-interface DNS configuration. If the DNS configuration is reverted all |
| per-interface DNS setting are reset to their defaults, undoing all effects of <command>dns</command>, |
| <command>domain</command>, <command>default-route</command>, <command>llmnr</command>, |
| <command>mdns</command>, <command>dnssec</command>, <command>dnsovertls</command>, |
| <command>nta</command>. Note that when a network interface disappears all configuration is lost |
| automatically, an explicit reverting is not necessary in that case.</para></listitem> |
| </varlistentry> |
| |
| <xi:include href="systemctl.xml" xpointer="log-level" /> |
| </variablelist> |
| </refsect1> |
| |
| <refsect1> |
| <title>Options</title> |
| <variablelist> |
| <varlistentry> |
| <term><option>-4</option></term> |
| <term><option>-6</option></term> |
| |
| <listitem><para>By default, when resolving a hostname, both IPv4 and IPv6 |
| addresses are acquired. By specifying <option>-4</option> only IPv4 addresses are requested, by specifying |
| <option>-6</option> only IPv6 addresses are requested.</para> |
| </listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><option>-i</option> <replaceable>INTERFACE</replaceable></term> |
| <term><option>--interface=</option><replaceable>INTERFACE</replaceable></term> |
| |
| <listitem><para>Specifies the network interface to execute the query on. This may either be specified as numeric |
| interface index or as network interface string (e.g. <literal>en0</literal>). Note that this option has no |
| effect if system-wide DNS configuration (as configured in <filename>/etc/resolv.conf</filename> or |
| <filename>/etc/systemd/resolve.conf</filename>) in place of per-link configuration is used.</para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><option>-p</option> <replaceable>PROTOCOL</replaceable></term> |
| <term><option>--protocol=</option><replaceable>PROTOCOL</replaceable></term> |
| |
| <listitem><para>Specifies the network protocol for the query. May be one of <literal>dns</literal> |
| (i.e. classic unicast DNS), <literal>llmnr</literal> (<ulink |
| url="https://tools.ietf.org/html/rfc4795">Link-Local Multicast Name Resolution</ulink>), |
| <literal>llmnr-ipv4</literal>, <literal>llmnr-ipv6</literal> (LLMNR via the indicated underlying IP |
| protocols), <literal>mdns</literal> (<ulink url="https://www.ietf.org/rfc/rfc6762.txt">Multicast DNS</ulink>), |
| <literal>mdns-ipv4</literal>, <literal>mdns-ipv6</literal> (MDNS via the indicated underlying IP protocols). |
| By default the lookup is done via all protocols suitable for the lookup. If used, limits the set of |
| protocols that may be used. Use this option multiple times to enable resolving via multiple protocols at the |
| same time. The setting <literal>llmnr</literal> is identical to specifying this switch once with |
| <literal>llmnr-ipv4</literal> and once via <literal>llmnr-ipv6</literal>. Note that this option does not force |
| the service to resolve the operation with the specified protocol, as that might require a suitable network |
| interface and configuration. |
| The special value <literal>help</literal> may be used to list known values. |
| </para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><option>-t</option> <replaceable>TYPE</replaceable></term> |
| <term><option>--type=</option><replaceable>TYPE</replaceable></term> |
| <term><option>-c</option> <replaceable>CLASS</replaceable></term> |
| <term><option>--class=</option><replaceable>CLASS</replaceable></term> |
| |
| <listitem><para>Specifies the DNS resource record type (e.g. A, AAAA, MX, …) and class (e.g. IN, ANY, …) to |
| look up. If these options are used a DNS resource record set matching the specified class and type is |
| requested. The class defaults to IN if only a type is specified. |
| The special value <literal>help</literal> may be used to list known values. |
| </para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><option>--service-address=</option><replaceable>BOOL</replaceable></term> |
| |
| <listitem><para>Takes a boolean parameter. If true (the default), when doing a service lookup with |
| <option>--service</option> the hostnames contained in the SRV resource records are resolved as well.</para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><option>--service-txt=</option><replaceable>BOOL</replaceable></term> |
| |
| <listitem><para>Takes a boolean parameter. If true (the default), when doing a DNS-SD service lookup with |
| <option>--service</option> the TXT service metadata record is resolved as well.</para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><option>--cname=</option><replaceable>BOOL</replaceable></term> |
| |
| <listitem><para>Takes a boolean parameter. If true (the default), DNS CNAME or DNAME redirections are |
| followed. Otherwise, if a CNAME or DNAME record is encountered while resolving, an error is |
| returned.</para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><option>--search=</option><replaceable>BOOL</replaceable></term> |
| |
| <listitem><para>Takes a boolean parameter. If true (the default), any specified single-label hostnames will be |
| searched in the domains configured in the search domain list, if it is non-empty. Otherwise, the search domain |
| logic is disabled.</para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><option>--raw</option><optional>=payload|packet</optional></term> |
| |
| <listitem><para>Dump the answer as binary data. If there is no argument or if the argument is |
| <literal>payload</literal>, the payload of the packet is exported. If the argument is |
| <literal>packet</literal>, the whole packet is dumped in wire format, prefixed by |
| length specified as a little-endian 64-bit number. This format allows multiple packets |
| to be dumped and unambiguously parsed.</para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><option>--legend=</option><replaceable>BOOL</replaceable></term> |
| |
| <listitem><para>Takes a boolean parameter. If true (the default), column headers and meta information about the |
| query response are shown. Otherwise, this output is suppressed.</para></listitem> |
| </varlistentry> |
| |
| <xi:include href="standard-options.xml" xpointer="help" /> |
| <xi:include href="standard-options.xml" xpointer="version" /> |
| <xi:include href="standard-options.xml" xpointer="no-pager" /> |
| </variablelist> |
| </refsect1> |
| |
| <refsect1> |
| <title>Compatibility with |
| <citerefentry project="debian"><refentrytitle>resolvconf</refentrytitle><manvolnum>8</manvolnum></citerefentry></title> |
| |
| <para><command>resolvectl</command> is a multi-call binary. When invoked as <literal>resolvconf</literal> |
| (generally achieved by means of a symbolic link of this name to the <command>resolvectl</command> binary) it |
| is run in a limited |
| <citerefentry project="debian"><refentrytitle>resolvconf</refentrytitle><manvolnum>8</manvolnum></citerefentry> |
| compatibility mode. It accepts mostly the same arguments and pushes all data into |
| <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>, |
| similar to how <option>dns</option> and <option>domain</option> commands operate. Note that |
| <command>systemd-resolved.service</command> is the only supported backend, which is different from other |
| implementations of this command.</para> |
| |
| <para><filename>/etc/resolv.conf</filename> will only be updated with servers added with this command |
| when <filename>/etc/resolv.conf</filename> is a symlink to |
| <filename>/run/systemd/resolve/resolv.conf</filename>, and not a static file. See the discussion of |
| <filename>/etc/resolv.conf</filename> handling in |
| <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>. |
| </para> |
| |
| <para>Not all operations supported by other implementations are supported natively. Specifically:</para> |
| |
| <variablelist> |
| <varlistentry> |
| <term><option>-a</option></term> |
| <listitem><para>Registers per-interface DNS configuration data with |
| <command>systemd-resolved</command>. Expects a network interface name as only command line argument. Reads |
| <citerefentry project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>-compatible |
| DNS configuration data from its standard input. Relevant fields are <literal>nameserver</literal> and |
| <literal>domain</literal>/<literal>search</literal>. This command is mostly identical to invoking |
| <command>resolvectl</command> with a combination of <option>dns</option> and <option>domain</option> |
| commands.</para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><option>-d</option></term> |
| <listitem><para>Unregisters per-interface DNS configuration data with <command>systemd-resolved</command>. This |
| command is mostly identical to invoking <command>resolvectl revert</command>.</para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><option>-f</option></term> |
| |
| <listitem><para>When specified <option>-a</option> and <option>-d</option> will not complain about missing |
| network interfaces and will silently execute no operation in that case.</para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><option>-x</option></term> |
| |
| <listitem><para>This switch for "exclusive" operation is supported only partially. It is mapped to an |
| additional configured search domain of <literal>~.</literal> — i.e. ensures that DNS traffic is preferably |
| routed to the DNS servers on this interface, unless there are other, more specific domains configured on other |
| interfaces.</para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><option>-m</option></term> |
| <term><option>-p</option></term> |
| |
| <listitem><para>These switches are not supported and are silently ignored.</para></listitem> |
| </varlistentry> |
| |
| <varlistentry> |
| <term><option>-u</option></term> |
| <term><option>-I</option></term> |
| <term><option>-i</option></term> |
| <term><option>-l</option></term> |
| <term><option>-R</option></term> |
| <term><option>-r</option></term> |
| <term><option>-v</option></term> |
| <term><option>-V</option></term> |
| <term><option>--enable-updates</option></term> |
| <term><option>--disable-updates</option></term> |
| <term><option>--are-updates-enabled</option></term> |
| |
| <listitem><para>These switches are not supported and the command will fail if used.</para></listitem> |
| </varlistentry> |
| |
| </variablelist> |
| |
| <para>See |
| <citerefentry project="debian"><refentrytitle>resolvconf</refentrytitle><manvolnum>8</manvolnum></citerefentry> |
| for details on those command line options.</para> |
| </refsect1> |
| |
| <refsect1> |
| <title>Examples</title> |
| |
| <example> |
| <title>Retrieve the addresses of the <literal>www.0pointer.net</literal> domain</title> |
| |
| <programlisting>$ resolvectl query www.0pointer.net |
| www.0pointer.net: 2a01:238:43ed:c300:10c3:bcf3:3266:da74 |
| 85.214.157.71 |
| |
| -- Information acquired via protocol DNS in 611.6ms. |
| -- Data is authenticated: no |
| </programlisting> |
| </example> |
| |
| <example> |
| <title>Retrieve the domain of the <literal>85.214.157.71</literal> IP address</title> |
| |
| <programlisting>$ resolvectl query 85.214.157.71 |
| 85.214.157.71: gardel.0pointer.net |
| |
| -- Information acquired via protocol DNS in 1.2997s. |
| -- Data is authenticated: no |
| </programlisting> |
| </example> |
| |
| <example> |
| <title>Retrieve the MX record of the <literal>yahoo.com</literal> domain</title> |
| |
| <programlisting>$ resolvectl --legend=no -t MX query yahoo.com |
| yahoo.com. IN MX 1 mta7.am0.yahoodns.net |
| yahoo.com. IN MX 1 mta6.am0.yahoodns.net |
| yahoo.com. IN MX 1 mta5.am0.yahoodns.net |
| </programlisting> |
| </example> |
| |
| <example> |
| <title>Resolve an SRV service</title> |
| |
| <programlisting>$ resolvectl service _xmpp-server._tcp gmail.com |
| _xmpp-server._tcp/gmail.com: alt1.xmpp-server.l.google.com:5269 [priority=20, weight=0] |
| 173.194.210.125 |
| alt4.xmpp-server.l.google.com:5269 [priority=20, weight=0] |
| 173.194.65.125 |
| … |
| </programlisting> |
| </example> |
| |
| <example> |
| <title>Retrieve a PGP key</title> |
| |
| <programlisting>$ resolvectl openpgp zbyszek@fedoraproject.org |
| d08ee310438ca124a6149ea5cc21b6313b390dce485576eff96f8722._openpgpkey.fedoraproject.org. IN OPENPGPKEY |
| mQINBFBHPMsBEACeInGYJCb+7TurKfb6wGyTottCDtiSJB310i37/6ZYoeIay/5soJjlMyf |
| MFQ9T2XNT/0LM6gTa0MpC1st9LnzYTMsT6tzRly1D1UbVI6xw0g0vE5y2Cjk3xUwAynCsSs |
| … |
| </programlisting> |
| </example> |
| |
| <example> |
| <title>Retrieve a TLS key (<literal>tcp</literal> and |
| <literal>:443</literal> could be skipped)</title> |
| |
| <programlisting>$ resolvectl tlsa tcp fedoraproject.org:443 |
| _443._tcp.fedoraproject.org IN TLSA 0 0 1 19400be5b7a31fb733917700789d2f0a2471c0c9d506c0e504c06c16d7cb17c0 |
| -- Cert. usage: CA constraint |
| -- Selector: Full Certificate |
| -- Matching type: SHA-256 |
| </programlisting> |
| </example> |
| </refsect1> |
| |
| <refsect1> |
| <title>See Also</title> |
| <para> |
| <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>, |
| <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>, |
| <citerefentry><refentrytitle>systemd.dnssd</refentrytitle><manvolnum>5</manvolnum></citerefentry>, |
| <citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>, |
| <citerefentry><refentrytitle>resolvconf</refentrytitle><manvolnum>8</manvolnum></citerefentry> |
| </para> |
| </refsect1> |
| </refentry> |