mirror of
https://github.com/systemd/systemd
synced 2024-09-06 16:56:43 +00:00
691 lines
36 KiB
XML
691 lines
36 KiB
XML
<?xml version='1.0'?>
|
|
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
|
|
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
|
|
<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
|
|
|
|
<refentry id="resolvectl" conditional='ENABLE_RESOLVE'
|
|
xmlns:xi="http://www.w3.org/2001/XInclude">
|
|
|
|
<refentryinfo>
|
|
<title>resolvectl</title>
|
|
<productname>systemd</productname>
|
|
</refentryinfo>
|
|
|
|
<refmeta>
|
|
<refentrytitle>resolvectl</refentrytitle>
|
|
<manvolnum>1</manvolnum>
|
|
</refmeta>
|
|
|
|
<refnamediv>
|
|
<refname>resolvectl</refname>
|
|
<refname>resolvconf</refname>
|
|
<refpurpose>Resolve domain names, IPV4 and IPv6 addresses, DNS resource records, and services; introspect and reconfigure the DNS resolver</refpurpose>
|
|
</refnamediv>
|
|
|
|
<refsynopsisdiv>
|
|
<cmdsynopsis>
|
|
<command>resolvectl</command>
|
|
<arg choice="opt" rep="repeat">OPTIONS</arg>
|
|
<arg choice="req">COMMAND</arg>
|
|
<arg choice="opt" rep="repeat">NAME</arg>
|
|
</cmdsynopsis>
|
|
</refsynopsisdiv>
|
|
|
|
<refsect1>
|
|
<title>Description</title>
|
|
|
|
<para><command>resolvectl</command> may be used to resolve domain names, IPv4 and IPv6 addresses, DNS resource
|
|
records and services with the
|
|
<citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
|
|
resolver service. By default, the specified list of parameters will be resolved as hostnames, retrieving their IPv4
|
|
and IPv6 addresses. If the parameters specified are formatted as IPv4 or IPv6 addresses the reverse operation is
|
|
done, and a hostname is retrieved for the specified addresses.</para>
|
|
|
|
<para>The program's output contains information about the protocol used for the look-up and on which network
|
|
interface the data was discovered. It also contains information on whether the information could be
|
|
authenticated. All data for which local DNSSEC validation succeeds is considered authenticated. Moreover all data
|
|
originating from local, trusted sources is also reported authenticated, including resolution of the local host
|
|
name, the <literal>localhost</literal> hostname or all data from <filename>/etc/hosts</filename>.</para>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>Commands</title>
|
|
<variablelist>
|
|
|
|
<varlistentry>
|
|
<term><command>query</command> <replaceable>HOSTNAME|ADDRESS</replaceable>…</term>
|
|
|
|
<listitem><para>Resolve domain names, as well as IPv4 and IPv6 addresses. When used in conjunction
|
|
with <option>--type=</option> or <option>--class=</option> (see below), resolves low-level DNS
|
|
resource records.</para>
|
|
|
|
<para>If a single-label domain name is specified it is searched for according to the configured
|
|
search domains — unless <option>--search=no</option> or
|
|
<option>--type=</option>/<option>--class=</option> are specified, both of which turn this logic
|
|
off.</para>
|
|
|
|
<para>If an international domain name is specified, it is automatically translated according to IDNA
|
|
rules when resolved via classic DNS — but not for look-ups via MulticastDNS or LLMNR. If
|
|
<option>--type=</option>/<option>--class=</option> is used IDNA translation is turned off and domain
|
|
names are processed as specified.</para>
|
|
|
|
<para>If combined with <option>--json=</option> (only supported in combination with
|
|
<option>--type=</option>) will output the resource record data in a JSON object.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><command>service</command>
|
|
[[<replaceable>NAME</replaceable>] <replaceable>TYPE</replaceable>]
|
|
<replaceable>DOMAIN</replaceable></term>
|
|
|
|
<listitem><para>Resolve <ulink url="https://tools.ietf.org/html/rfc6763">RFC 6763 DNS-SD</ulink> and
|
|
<ulink url="https://tools.ietf.org/html/rfc2782">RFC 2782 SRV</ulink> services, depending on the
|
|
specified list of parameters. If three parameters are passed the first is assumed to be the DNS-SD
|
|
service name, the second the <constant class='dns'>SRV</constant> service type, and the third the
|
|
domain to search in. In this case a full DNS-SD style <constant class='dns'>SRV</constant> and
|
|
<constant class='dns'>TXT</constant> lookup is executed. If only two parameters are specified, the
|
|
first is assumed to be the <constant class='dns'>SRV</constant> service type, and the second the
|
|
domain to look in. In this case no <constant class='dns'>TXT</constant> resource record is requested.
|
|
Finally, if only one parameter is specified, it is assumed to be a domain name, that is already
|
|
prefixed with an <constant class='dns'>SRV</constant> type, and an <constant
|
|
class='dns'>SRV</constant> lookup is done (no <constant class='dns'>TXT</constant>).</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><command>openpgp</command> <replaceable>EMAIL@DOMAIN</replaceable>…</term>
|
|
|
|
<listitem><para>Query PGP keys stored as <constant class='dns'>OPENPGPKEY</constant> resource records,
|
|
see <ulink url="https://tools.ietf.org/html/rfc7929">RFC 7929</ulink>. Specified e-mail addresses
|
|
are converted to the corresponding DNS domain name, and any <constant class='dns'>OPENPGPKEY</constant>
|
|
keys are printed.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><command>tlsa</command>
|
|
[<replaceable>FAMILY</replaceable>]
|
|
<replaceable>DOMAIN</replaceable>[:<replaceable>PORT</replaceable>]…</term>
|
|
|
|
<listitem><para>Query TLS public keys stored as <constant class='dns'>TLSA</constant> resource
|
|
records, see <ulink url="https://tools.ietf.org/html/rfc6698">RFC 6698</ulink>. A query will be
|
|
performed for each of the specified names prefixed with the port and family
|
|
(<literal>_<replaceable>port</replaceable>._<replaceable>family</replaceable>.<replaceable>domain</replaceable></literal>).
|
|
The port number may be specified after a colon (<literal>:</literal>), otherwise
|
|
<constant>443</constant> will be used by default. The family may be specified as the first argument,
|
|
otherwise <constant>tcp</constant> will be used.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><command>status</command> [<replaceable>LINK</replaceable>…]</term>
|
|
|
|
<listitem><para>Shows the global and per-link DNS settings currently in effect. If no command is specified,
|
|
this is the implied default.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><command>statistics</command></term>
|
|
|
|
<listitem><para>Shows general resolver statistics, including information whether DNSSEC is
|
|
enabled and available, as well as resolution and validation statistics.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><command>reset-statistics</command></term>
|
|
|
|
<listitem><para>Resets the statistics counters shown in <command>statistics</command> to zero.
|
|
This operation requires root privileges.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><command>flush-caches</command></term>
|
|
|
|
<listitem><para>Flushes all DNS resource record caches the service maintains locally. This is mostly
|
|
equivalent to sending the <constant>SIGUSR2</constant> to the <command>systemd-resolved</command>
|
|
service.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><command>reset-server-features</command></term>
|
|
|
|
<listitem><para>Flushes all feature level information the resolver learnt about specific servers, and ensures
|
|
that the server feature probing logic is started from the beginning with the next look-up request. This is
|
|
mostly equivalent to sending the <constant>SIGRTMIN+1</constant> to the <command>systemd-resolved</command>
|
|
service.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><command>dns</command> [<replaceable>LINK</replaceable> [<replaceable>SERVER</replaceable>…]]</term>
|
|
<term><command>domain</command> [<replaceable>LINK</replaceable> [<replaceable>DOMAIN</replaceable>…]]</term>
|
|
<term><command>default-route</command> [<replaceable>LINK</replaceable> [<replaceable>BOOL</replaceable>…]]</term>
|
|
<term><command>llmnr</command> [<replaceable>LINK</replaceable> [<replaceable>MODE</replaceable>]]</term>
|
|
<term><command>mdns</command> [<replaceable>LINK</replaceable> [<replaceable>MODE</replaceable>]]</term>
|
|
<term><command>dnssec</command> [<replaceable>LINK</replaceable> [<replaceable>MODE</replaceable>]]</term>
|
|
<term><command>dnsovertls</command> [<replaceable>LINK</replaceable> [<replaceable>MODE</replaceable>]]</term>
|
|
<term><command>nta</command> [<replaceable>LINK</replaceable> [<replaceable>DOMAIN</replaceable>…]]</term>
|
|
|
|
<listitem>
|
|
<para>Get/set per-interface DNS configuration. These commands may be used to configure various DNS
|
|
settings for network interfaces. These commands may be used to inform
|
|
<command>systemd-resolved</command> or <command>systemd-networkd</command> about per-interface DNS
|
|
configuration determined through external means. The <command>dns</command> command expects IPv4 or
|
|
IPv6 address specifications of DNS servers to use. Each address can optionally take a port number
|
|
separated with <literal>:</literal>, a network interface name or index separated with
|
|
<literal>%</literal>, and a Server Name Indication (SNI) separated with <literal>#</literal>. When
|
|
IPv6 address is specified with a port number, then the address must be in the square brackets. That
|
|
is, the acceptable full formats are <literal>111.222.333.444:9953%ifname#example.com</literal> for
|
|
IPv4 and <literal>[1111:2222::3333]:9953%ifname#example.com</literal> for IPv6. The
|
|
<command>domain</command> command expects valid DNS domains, possibly prefixed with
|
|
<literal>~</literal>, and configures a per-interface search or route-only domain. The
|
|
<command>default-route</command> command expects a boolean parameter, and configures whether the
|
|
link may be used as default route for DNS lookups, i.e. if it is suitable for lookups on domains no
|
|
other link explicitly is configured for. The <command>llmnr</command>, <command>mdns</command>,
|
|
<command>dnssec</command> and <command>dnsovertls</command> commands may be used to configure the
|
|
per-interface LLMNR, MulticastDNS, DNSSEC and DNSOverTLS settings. Finally, <command>nta</command>
|
|
command may be used to configure additional per-interface DNSSEC NTA domains.</para>
|
|
|
|
<para>Commands <command>dns</command>, <command>domain</command> and <command>nta</command> can take
|
|
a single empty string argument to clear their respective value lists.</para>
|
|
|
|
<para>For details about these settings, their possible values and their effect, see the
|
|
corresponding settings in
|
|
<citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><command>revert <replaceable>LINK</replaceable></command></term>
|
|
|
|
<listitem><para>Revert the per-interface DNS configuration. If the DNS configuration is reverted all
|
|
per-interface DNS setting are reset to their defaults, undoing all effects of <command>dns</command>,
|
|
<command>domain</command>, <command>default-route</command>, <command>llmnr</command>,
|
|
<command>mdns</command>, <command>dnssec</command>, <command>dnsovertls</command>,
|
|
<command>nta</command>. Note that when a network interface disappears all configuration is lost
|
|
automatically, an explicit reverting is not necessary in that case.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><command>monitor</command></term>
|
|
|
|
<listitem><para>Show a continuous stream of local client resolution queries and their
|
|
responses. Whenever a local query is completed the query's DNS resource lookup key and resource
|
|
records are shown. Note that this displays queries issued locally only, and does not immediately
|
|
relate to DNS requests submitted to configured DNS servers or the LLMNR or MulticastDNS zones, as
|
|
lookups may be answered from the local cache, or might result in multiple DNS transactions (for
|
|
example to validate DNSSEC information). If CNAME/CNAME redirection chains are followed, a separate
|
|
query will be displayed for each element of the chain. Use <option>--json=</option> to enable JSON
|
|
output.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v252"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><command>show-cache</command></term>
|
|
|
|
<listitem><para>Show current cache content, per scope. Use <option>--json=</option> to enable JSON
|
|
output.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v254"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><command>show-server-state</command></term>
|
|
|
|
<listitem><para>Show detailed server state information, per DNS Server. Use <option>--json=</option>
|
|
to enable JSON output.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v255"/></listitem>
|
|
</varlistentry>
|
|
|
|
<xi:include href="systemctl.xml" xpointer="log-level" />
|
|
</variablelist>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>Options</title>
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><option>-4</option></term>
|
|
<term><option>-6</option></term>
|
|
|
|
<listitem><para>By default, when resolving a hostname, both IPv4 and IPv6
|
|
addresses are acquired. By specifying <option>-4</option> only IPv4 addresses are requested, by specifying
|
|
<option>-6</option> only IPv6 addresses are requested.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>-i</option> <replaceable>INTERFACE</replaceable></term>
|
|
<term><option>--interface=<replaceable>INTERFACE</replaceable></option></term>
|
|
|
|
<listitem><para>Specifies the network interface to execute the query on. This may either be specified as numeric
|
|
interface index or as network interface string (e.g. <literal>en0</literal>). Note that this option has no
|
|
effect if system-wide DNS configuration (as configured in <filename>/etc/resolv.conf</filename> or
|
|
<filename>/etc/systemd/resolved.conf</filename>) in place of per-link configuration is used.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>-p</option> <replaceable>PROTOCOL</replaceable></term>
|
|
<term><option>--protocol=<replaceable>PROTOCOL</replaceable></option></term>
|
|
|
|
<listitem><para>Specifies the network protocol for the query. May be one of <literal>dns</literal>
|
|
(i.e. classic unicast DNS), <literal>llmnr</literal> (<ulink
|
|
url="https://tools.ietf.org/html/rfc4795">Link-Local Multicast Name Resolution</ulink>),
|
|
<literal>llmnr-ipv4</literal>, <literal>llmnr-ipv6</literal> (LLMNR via the indicated underlying IP
|
|
protocols), <literal>mdns</literal> (<ulink url="https://www.ietf.org/rfc/rfc6762.txt">Multicast DNS</ulink>),
|
|
<literal>mdns-ipv4</literal>, <literal>mdns-ipv6</literal> (MDNS via the indicated underlying IP protocols).
|
|
By default the lookup is done via all protocols suitable for the lookup. If used, limits the set of
|
|
protocols that may be used. Use this option multiple times to enable resolving via multiple protocols at the
|
|
same time. The setting <literal>llmnr</literal> is identical to specifying this switch once with
|
|
<literal>llmnr-ipv4</literal> and once via <literal>llmnr-ipv6</literal>. Note that this option does not force
|
|
the service to resolve the operation with the specified protocol, as that might require a suitable network
|
|
interface and configuration.
|
|
The special value <literal>help</literal> may be used to list known values.
|
|
</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>-t</option> <replaceable>TYPE</replaceable></term>
|
|
<term><option>--type=<replaceable>TYPE</replaceable></option></term>
|
|
<term><option>-c</option> <replaceable>CLASS</replaceable></term>
|
|
<term><option>--class=<replaceable>CLASS</replaceable></option></term>
|
|
|
|
<listitem><para>When used in conjunction with the <command>query</command> command, specifies the DNS
|
|
resource record type (e.g. <constant class='dns'>A</constant>, <constant class='dns'>AAAA</constant>,
|
|
<constant class='dns'>MX</constant>, …) and class (e.g. <constant>IN</constant>,
|
|
<constant>ANY</constant>, …) to look up. If these options are used a DNS resource record set matching
|
|
the specified class and type is requested. The class defaults to <constant>IN</constant> if only a
|
|
type is specified. The special value <literal>help</literal> may be used to list known values.</para>
|
|
|
|
<para>Without these options <command>resolvectl query</command> provides high-level domain name to
|
|
address and address to domain name resolution. With these options it provides low-level DNS resource
|
|
record resolution. The search domain logic is automatically turned off when these options are used,
|
|
i.e. specified domain names need to be fully qualified domain names. Moreover, IDNA internal domain
|
|
name translation is turned off as well, i.e. international domain names should be specified in
|
|
<literal>xn--…</literal> notation, unless look-up in MulticastDNS/LLMNR is desired, in which case
|
|
UTF-8 characters should be used.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--service-address=<replaceable>BOOL</replaceable></option></term>
|
|
|
|
<listitem><para>Takes a boolean parameter. If true (the default), when doing a service lookup with
|
|
<option>--service</option> the hostnames contained in the <constant class='dns'>SRV</constant>
|
|
resource records are resolved as well.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--service-txt=<replaceable>BOOL</replaceable></option></term>
|
|
|
|
<listitem><para>Takes a boolean parameter. If true (the default), when doing a DNS-SD service lookup
|
|
with <option>--service</option> the <constant class='dns'>TXT</constant> service metadata record is
|
|
resolved as well.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--cname=<replaceable>BOOL</replaceable></option></term>
|
|
|
|
<listitem><para>Takes a boolean parameter. If true (the default), DNS <constant
|
|
class='dns'>CNAME</constant> or <constant class='dns'>DNAME</constant> redirections are
|
|
followed. Otherwise, if a CNAME or DNAME record is encountered while resolving, an error is
|
|
returned.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--validate=<replaceable>BOOL</replaceable></option></term>
|
|
|
|
<listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
|
|
(the default), DNSSEC validation is applied as usual — under the condition that it is enabled for the
|
|
network and for <filename>systemd-resolved.service</filename> as a whole. If false, DNSSEC validation
|
|
is disabled for the specific query, regardless of whether it is enabled for the network or in the
|
|
service. Note that setting this option to true does not force DNSSEC validation on systems/networks
|
|
where DNSSEC is turned off. This option is only suitable to turn off such validation where otherwise
|
|
enabled, not enable validation where otherwise disabled.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v248"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--synthesize=<replaceable>BOOL</replaceable></option></term>
|
|
|
|
<listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
|
|
(the default), select domains are resolved on the local system, among them
|
|
<literal>localhost</literal>, <literal>_gateway</literal>, <literal>_outbound</literal>,
|
|
<literal>_localdnsstub</literal> and <literal>_localdnsproxy</literal> or entries from
|
|
<filename>/etc/hosts</filename>. If false these domains are not resolved locally, and either fail (in
|
|
case of <literal>localhost</literal>, <literal>_gateway</literal> or <literal>_outbound</literal> and
|
|
suchlike) or go to the network via regular DNS/mDNS/LLMNR lookups (in case of
|
|
<filename>/etc/hosts</filename> entries).</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v248"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--cache=<replaceable>BOOL</replaceable></option></term>
|
|
|
|
<listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
|
|
(the default), lookups use the local DNS resource record cache. If false, lookups are routed to the
|
|
network instead, regardless if already available in the local cache.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v248"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--zone=<replaceable>BOOL</replaceable></option></term>
|
|
|
|
<listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
|
|
(the default), lookups are answered from locally registered LLMNR or mDNS resource records, if
|
|
defined. If false, locally registered LLMNR/mDNS records are not considered for the lookup
|
|
request.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v248"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--trust-anchor=<replaceable>BOOL</replaceable></option></term>
|
|
|
|
<listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
|
|
(the default), lookups for DS and DNSKEY are answered from the local DNSSEC trust anchors if
|
|
possible. If false, the local trust store is not considered for the lookup request.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v248"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--network=<replaceable>BOOL</replaceable></option></term>
|
|
|
|
<listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
|
|
(the default), lookups are answered via DNS, LLMNR or mDNS network requests if they cannot be
|
|
synthesized locally, or be answered from the local cache, zone or trust anchors (see above). If false,
|
|
the request is not answered from the network and will thus fail if none of the indicated sources can
|
|
answer them.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v248"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--search=<replaceable>BOOL</replaceable></option></term>
|
|
|
|
<listitem><para>Takes a boolean parameter. If true (the default), any specified single-label
|
|
hostnames will be searched in the domains configured in the search domain list, if it is
|
|
non-empty. Otherwise, the search domain logic is disabled. Note that this option has no effect if
|
|
<option>--type=</option> is used (see above), in which case the search domain logic is
|
|
unconditionally turned off.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--raw</option><optional>=payload|packet</optional></term>
|
|
|
|
<listitem><para>Dump the answer as binary data. If there is no argument or if the argument is
|
|
<literal>payload</literal>, the payload of the packet is exported. If the argument is
|
|
<literal>packet</literal>, the whole packet is dumped in wire format, prefixed by
|
|
length specified as a little-endian 64-bit number. This format allows multiple packets
|
|
to be dumped and unambiguously parsed.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--legend=<replaceable>BOOL</replaceable></option></term>
|
|
|
|
<listitem><para>Takes a boolean parameter. If true (the default), column headers and meta information about the
|
|
query response are shown. Otherwise, this output is suppressed.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--stale-data=<replaceable>BOOL</replaceable></option></term>
|
|
|
|
<listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
|
|
(the default), lookups are answered with stale data (expired resource records) if
|
|
possible. If false, the stale data is not considered for the lookup request.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v254"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--relax-single-label=<replaceable>BOOL</replaceable></option></term>
|
|
|
|
<listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If
|
|
true, rules regarding routing of single-label names are relaxed. Defaults to false. By default,
|
|
lookups of single label names are assumed to refer to local hosts to be resolved via local resolution
|
|
such as LLMNR or via search domain qualification and are not routed to upstream servers as is. If
|
|
this option is enabled these rules are disabled and the queries are routed upstream anyway. Also see
|
|
the <varname>ResolveUnicastSingleLabel=</varname> option in
|
|
<citerefentry><refentrytitle>resolved.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
|
|
which provides a system-wide option that controls this behaviour.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v256"/></listitem>
|
|
</varlistentry>
|
|
|
|
<xi:include href="standard-options.xml" xpointer="json" />
|
|
<xi:include href="standard-options.xml" xpointer="j" />
|
|
<xi:include href="standard-options.xml" xpointer="no-pager" />
|
|
<xi:include href="standard-options.xml" xpointer="help" />
|
|
<xi:include href="standard-options.xml" xpointer="version" />
|
|
</variablelist>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>Compatibility with
|
|
<citerefentry project="debian"><refentrytitle>resolvconf</refentrytitle><manvolnum>8</manvolnum></citerefentry></title>
|
|
|
|
<para><command>resolvectl</command> is a multi-call binary. When invoked as <literal>resolvconf</literal>
|
|
(generally achieved by means of a symbolic link of this name to the <command>resolvectl</command> binary) it
|
|
is run in a limited
|
|
<citerefentry project="debian"><refentrytitle>resolvconf</refentrytitle><manvolnum>8</manvolnum></citerefentry>
|
|
compatibility mode. It accepts mostly the same arguments and pushes all data into
|
|
<citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
|
|
similar to how <option>dns</option> and <option>domain</option> commands operate. Note that
|
|
<command>systemd-resolved.service</command> is the only supported backend, which is different from other
|
|
implementations of this command.</para>
|
|
|
|
<para><filename>/etc/resolv.conf</filename> will only be updated with servers added with this command
|
|
when <filename>/etc/resolv.conf</filename> is a symlink to
|
|
<filename>/run/systemd/resolve/resolv.conf</filename>, and not a static file. See the discussion of
|
|
<filename>/etc/resolv.conf</filename> handling in
|
|
<citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
|
|
</para>
|
|
|
|
<para>Not all operations supported by other implementations are supported natively. Specifically:</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><option>-a</option></term>
|
|
<listitem><para>Registers per-interface DNS configuration data with
|
|
<command>systemd-resolved</command>. Expects a network interface name as only command line argument. Reads
|
|
<citerefentry project='man-pages'><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>-compatible
|
|
DNS configuration data from its standard input. Relevant fields are <literal>nameserver</literal> and
|
|
<literal>domain</literal>/<literal>search</literal>. This command is mostly identical to invoking
|
|
<command>resolvectl</command> with a combination of <option>dns</option> and <option>domain</option>
|
|
commands.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>-d</option></term>
|
|
<listitem><para>Unregisters per-interface DNS configuration data with <command>systemd-resolved</command>. This
|
|
command is mostly identical to invoking <command>resolvectl revert</command>.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>-f</option></term>
|
|
|
|
<listitem><para>When specified <option>-a</option> and <option>-d</option> will not complain about missing
|
|
network interfaces and will silently execute no operation in that case.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>-x</option></term>
|
|
|
|
<listitem><para>This switch for "exclusive" operation is supported only partially. It is mapped to an
|
|
additional configured search domain of <literal>~.</literal> — i.e. ensures that DNS traffic is preferably
|
|
routed to the DNS servers on this interface, unless there are other, more specific domains configured on other
|
|
interfaces.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>-m</option></term>
|
|
<term><option>-p</option></term>
|
|
|
|
<listitem><para>These switches are not supported and are silently ignored.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>-u</option></term>
|
|
<term><option>-I</option></term>
|
|
<term><option>-i</option></term>
|
|
<term><option>-l</option></term>
|
|
<term><option>-R</option></term>
|
|
<term><option>-r</option></term>
|
|
<term><option>-v</option></term>
|
|
<term><option>-V</option></term>
|
|
<term><option>--enable-updates</option></term>
|
|
<term><option>--disable-updates</option></term>
|
|
<term><option>--are-updates-enabled</option></term>
|
|
|
|
<listitem><para>These switches are not supported and the command will fail if used.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
|
|
</varlistentry>
|
|
|
|
</variablelist>
|
|
|
|
<para>See
|
|
<citerefentry project="debian"><refentrytitle>resolvconf</refentrytitle><manvolnum>8</manvolnum></citerefentry>
|
|
for details on those command line options.</para>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>Examples</title>
|
|
|
|
<example>
|
|
<title>Retrieve the addresses of the <literal>www.0pointer.net</literal> domain (<constant class='dns'>A</constant> and <constant class='dns'>AAAA</constant> resource records)</title>
|
|
|
|
<programlisting>$ resolvectl query www.0pointer.net
|
|
www.0pointer.net: 2a01:238:43ed:c300:10c3:bcf3:3266:da74
|
|
85.214.157.71
|
|
|
|
-- Information acquired via protocol DNS in 611.6ms.
|
|
-- Data is authenticated: no
|
|
</programlisting>
|
|
</example>
|
|
|
|
<example>
|
|
<title>Retrieve the domain of the <literal>85.214.157.71</literal> IP address
|
|
(<constant class='dns'>PTR</constant> resource record)</title>
|
|
|
|
<programlisting>$ resolvectl query 85.214.157.71
|
|
85.214.157.71: gardel.0pointer.net
|
|
|
|
-- Information acquired via protocol DNS in 1.2997s.
|
|
-- Data is authenticated: no
|
|
</programlisting>
|
|
</example>
|
|
|
|
<example>
|
|
<title>Retrieve the <constant class='dns'>MX</constant> record of the <literal>yahoo.com</literal>
|
|
domain</title>
|
|
|
|
<programlisting>$ resolvectl --legend=no -t MX query yahoo.com
|
|
yahoo.com. IN MX 1 mta7.am0.yahoodns.net
|
|
yahoo.com. IN MX 1 mta6.am0.yahoodns.net
|
|
yahoo.com. IN MX 1 mta5.am0.yahoodns.net
|
|
</programlisting>
|
|
</example>
|
|
|
|
<example>
|
|
<title>Resolve an <constant class='dns'>SRV</constant> service</title>
|
|
|
|
<programlisting>$ resolvectl service _xmpp-server._tcp gmail.com
|
|
_xmpp-server._tcp/gmail.com: alt1.xmpp-server.l.google.com:5269 [priority=20, weight=0]
|
|
173.194.210.125
|
|
alt4.xmpp-server.l.google.com:5269 [priority=20, weight=0]
|
|
173.194.65.125
|
|
…
|
|
</programlisting>
|
|
</example>
|
|
|
|
<example>
|
|
<title>Retrieve a PGP key (<constant class='dns'>OPENPGP</constant> resource record)</title>
|
|
|
|
<programlisting>$ resolvectl openpgp zbyszek@fedoraproject.org
|
|
d08ee310438ca124a6149ea5cc21b6313b390dce485576eff96f8722._openpgpkey.fedoraproject.org. IN OPENPGPKEY
|
|
mQINBFBHPMsBEACeInGYJCb+7TurKfb6wGyTottCDtiSJB310i37/6ZYoeIay/5soJjlMyf
|
|
MFQ9T2XNT/0LM6gTa0MpC1st9LnzYTMsT6tzRly1D1UbVI6xw0g0vE5y2Cjk3xUwAynCsSs
|
|
…
|
|
</programlisting>
|
|
</example>
|
|
|
|
<example>
|
|
<title>Retrieve a TLS key (<constant class='dns'>TLSA</constant> resource record)</title>
|
|
|
|
<programlisting>$ resolvectl tlsa tcp fedoraproject.org:443
|
|
_443._tcp.fedoraproject.org IN TLSA 0 0 1 19400be5b7a31fb733917700789d2f0a2471c0c9d506c0e504c06c16d7cb17c0
|
|
-- Cert. usage: CA constraint
|
|
-- Selector: Full Certificate
|
|
-- Matching type: SHA-256
|
|
</programlisting>
|
|
|
|
<para><literal>tcp</literal> and <literal>:443</literal> are optional and could be skipped.</para>
|
|
</example>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>See Also</title>
|
|
<para><simplelist type="inline">
|
|
<member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
|
|
<member><citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
|
|
<member><citerefentry><refentrytitle>systemd.dnssd</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
|
|
<member><citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
|
|
<member><citerefentry><refentrytitle>resolvconf</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
|
|
</simplelist></para>
|
|
</refsect1>
|
|
</refentry>
|