1RESOLVECTL(1)                     resolvectl                     RESOLVECTL(1)
2
3
4

NAME

6       resolvectl, resolvconf - Resolve domain names, IPV4 and IPv6 addresses,
7       DNS resource records, and services; introspect and reconfigure the DNS
8       resolver
9

SYNOPSIS

11       resolvectl [OPTIONS...] {COMMAND} [NAME...]
12

DESCRIPTION

14       resolvectl may be used to resolve domain names, IPv4 and IPv6
15       addresses, DNS resource records and services with the systemd-
16       resolved.service(8) resolver service. By default, the specified list of
17       parameters will be resolved as hostnames, retrieving their IPv4 and
18       IPv6 addresses. If the parameters specified are formatted as IPv4 or
19       IPv6 operation the reverse operation is done, and a hostname is
20       retrieved for the specified addresses.
21
22       The program's output contains information about the protocol used for
23       the look-up and on which network interface the data was discovered. It
24       also contains information on whether the information could be
25       authenticated. All data for which local DNSSEC validation succeeds is
26       considered authenticated. Moreover all data originating from local,
27       trusted sources is also reported authenticated, including resolution of
28       the local host name, the "localhost" host name or all data from
29       /etc/hosts.
30

OPTIONS

32       -4, -6
33           By default, when resolving a hostname, both IPv4 and IPv6 addresses
34           are acquired. By specifying -4 only IPv4 addresses are requested,
35           by specifying -6 only IPv6 addresses are requested.
36
37       -i INTERFACE, --interface=INTERFACE
38           Specifies the network interface to execute the query on. This may
39           either be specified as numeric interface index or as network
40           interface string (e.g.  "en0"). Note that this option has no effect
41           if system-wide DNS configuration (as configured in /etc/resolv.conf
42           or /etc/systemd/resolve.conf) in place of per-link configuration is
43           used.
44
45       -p PROTOCOL, --protocol=PROTOCOL
46           Specifies the network protocol for the query. May be one of "dns"
47           (i.e. classic unicast DNS), "llmnr" (Link-Local Multicast Name
48           Resolution[1]), "llmnr-ipv4", "llmnr-ipv6" (LLMNR via the indicated
49           underlying IP protocols), "mdns" (Multicast DNS[2]), "mdns-ipv4",
50           "mdns-ipv6" (MDNS via the indicated underlying IP protocols). By
51           default the lookup is done via all protocols suitable for the
52           lookup. If used, limits the set of protocols that may be used. Use
53           this option multiple times to enable resolving via multiple
54           protocols at the same time. The setting "llmnr" is identical to
55           specifying this switch once with "llmnr-ipv4" and once via
56           "llmnr-ipv6". Note that this option does not force the service to
57           resolve the operation with the specified protocol, as that might
58           require a suitable network interface and configuration. The special
59           value "help" may be used to list known values.
60
61       -t TYPE, --type=TYPE, -c CLASS, --class=CLASS
62           Specifies the DNS resource record type (e.g. A, AAAA, MX, ...) and
63           class (e.g. IN, ANY, ...) to look up. If these options are used a
64           DNS resource record set matching the specified class and type is
65           requested. The class defaults to IN if only a type is specified.
66           The special value "help" may be used to list known values.
67
68       --service-address=BOOL
69           Takes a boolean parameter. If true (the default), when doing a
70           service lookup with --service the hostnames contained in the SRV
71           resource records are resolved as well.
72
73       --service-txt=BOOL
74           Takes a boolean parameter. If true (the default), when doing a
75           DNS-SD service lookup with --service the TXT service metadata
76           record is resolved as well.
77
78       --cname=BOOL
79           Takes a boolean parameter. If true (the default), DNS CNAME or
80           DNAME redirections are followed. Otherwise, if a CNAME or DNAME
81           record is encountered while resolving, an error is returned.
82
83       --search=BOOL
84           Takes a boolean parameter. If true (the default), any specified
85           single-label hostnames will be searched in the domains configured
86           in the search domain list, if it is non-empty. Otherwise, the
87           search domain logic is disabled.
88
89       --raw[=payload|packet]
90           Dump the answer as binary data. If there is no argument or if the
91           argument is "payload", the payload of the packet is exported. If
92           the argument is "packet", the whole packet is dumped in wire
93           format, prefixed by length specified as a little-endian 64-bit
94           number. This format allows multiple packets to be dumped and
95           unambiguously parsed.
96
97       --legend=BOOL
98           Takes a boolean parameter. If true (the default), column headers
99           and meta information about the query response are shown. Otherwise,
100           this output is suppressed.
101
102       -h, --help
103           Print a short help text and exit.
104
105       --version
106           Print a short version string and exit.
107
108       --no-pager
109           Do not pipe output into a pager.
110

COMMANDS

112       query HOSTNAME|ADDRESS...
113           Resolve domain names, IPv4 and IPv6 addresses.
114
115       service [[NAME] TYPE] DOMAIN
116           Resolve DNS-SD[3] and SRV[4] services, depending on the specified
117           list of parameters. If three parameters are passed the first is
118           assumed to be the DNS-SD service name, the second the SRV service
119           type, and the third the domain to search in. In this case a full
120           DNS-SD style SRV and TXT lookup is executed. If only two parameters
121           are specified, the first is assumed to be the SRV service type, and
122           the second the domain to look in. In this case no TXT RR is
123           requested. Finally, if only one parameter is specified, it is
124           assumed to be a domain name, that is already prefixed with an SRV
125           type, and an SRV lookup is done (no TXT).
126
127       openpgp EMAIL@DOMAIN...
128           Query PGP keys stored as OPENPGPKEY[5] resource records. Specified
129           e-mail addresses are converted to the corresponding DNS domain
130           name, and any OPENPGPKEY keys are printed.
131
132       tlsa [FAMILY] DOMAIN[:PORT]...
133           Query TLS public keys stored as TLSA[6] resource records. A query
134           will be performed for each of the specified names prefixed with the
135           port and family ("_port._family.domain"). The port number may be
136           specified after a colon (":"), otherwise 443 will be used by
137           default. The family may be specified as the first argument,
138           otherwise tcp will be used.
139
140       status [LINK...]
141           Shows the global and per-link DNS settings currently in effect. If
142           no command is specified, this is the implied default.
143
144       statistics
145           Shows general resolver statistics, including information whether
146           DNSSEC is enabled and available, as well as resolution and
147           validation statistics.
148
149       reset-statistics
150           Resets the statistics counters shown in statistics to zero. This
151           operation requires root privileges.
152
153       flush-caches
154           Flushes all DNS resource record caches the service maintains
155           locally. This is mostly equivalent to sending the SIGUSR2 to the
156           systemd-resolved service.
157
158       reset-server-features
159           Flushes all feature level information the resolver learnt about
160           specific servers, and ensures that the server feature probing logic
161           is started from the beginning with the next look-up request. This
162           is mostly equivalent to sending the SIGRTMIN+1 to the
163           systemd-resolved service.
164
165       dns [LINK [SERVER...]], domain [LINK [DOMAIN...]], default-route [LINK
166       [BOOL...]], llmnr [LINK [MODE]], mdns [LINK [MODE]], dnssec [LINK
167       [MODE]], dnsovertls [LINK [MODE]], nta [LINK [DOMAIN...]]
168           Get/set per-interface DNS configuration. These commands may be used
169           to configure various DNS settings for network interfaces. These
170           commands may be used to inform systemd-resolved or systemd-networkd
171           about per-interface DNS configuration determined through external
172           means. The dns command expects IPv4 or IPv6 address specifications
173           of DNS servers to use. The domain command expects valid DNS
174           domains, possibly prefixed with "~", and configures a per-interface
175           search or route-only domain. The default-route command expects a
176           boolean parameter, and configures whether the link may be used as
177           default route for DNS lookups, i.e. if it is suitable for lookups
178           on domains no other link explicitly is configured for. The llmnr,
179           mdns, dnssec and dnsovertls commands may be used to configure the
180           per-interface LLMNR, MulticastDNS, DNSSEC and DNSOverTLS settings.
181           Finally, nta command may be used to configure additional
182           per-interface DNSSEC NTA domains.
183
184           Options dns, domain and nta can take a single empty string argument
185           to clear their respective value lists.
186
187           For details about these settings, their possible values and their
188           effect, see the corresponding options in systemd.network(5).
189
190       revert LINK
191           Revert the per-interface DNS configuration. If the DNS
192           configuration is reverted all per-interface DNS setting are reset
193           to their defaults, undoing all effects of dns, domain,
194           default-route, llmnr, mdns, dnssec, dnsovertls, nta. Note that when
195           a network interface disappears all configuration is lost
196           automatically, an explicit reverting is not necessary in that case.
197

COMPATIBILITY WITH RESOLVCONF(8)

199       resolvectl is a multi-call binary. When invoked as "resolvconf"
200       (generally achieved by means of a symbolic link of this name to the
201       resolvectl binary) it is run in a limited resolvconf(8) compatibility
202       mode. It accepts mostly the same arguments and pushes all data into
203       systemd-resolved.service(8), similar to how dns and domain commands
204       operate. Note that systemd-resolved.service is the only supported
205       backend, which is different from other implementations of this command.
206       Note that not all operations supported by other implementations are
207       supported natively. Specifically:
208
209       -a
210           Registers per-interface DNS configuration data with
211           systemd-resolved. Expects a network interface name as only command
212           line argument. Reads resolv.conf(5) compatible DNS configuration
213           data from its standard input. Relevant fields are "nameserver" and
214           "domain"/"search". This command is mostly identical to invoking
215           resolvectl with a combination of dns and domain commands.
216
217       -d
218           Unregisters per-interface DNS configuration data with
219           systemd-resolved. This command is mostly identical to invoking
220           resolvectl revert.
221
222       -f
223           When specified -a and -d will not complain about missing network
224           interfaces and will silently execute no operation in that case.
225
226       -x
227           This switch for "exclusive" operation is supported only partially.
228           It is mapped to an additional configured search domain of "~."  —
229           i.e. ensures that DNS traffic is preferably routed to the DNS
230           servers on this interface, unless there are other, more specific
231           domains configured on other interfaces.
232
233       -m, -p
234           These switches are not supported and are silently ignored.
235
236       -u, -I, -i, -l, -R, -r, -v, -V, --enable-updates, --disable-updates,
237       --are-updates-enabled
238           These switches are not supported and the command will fail if used.
239
240       See resolvconf(8) for details on this command line options.
241

EXAMPLES

243       Example 1. Retrieve the addresses of the "www.0pointer.net" domain
244
245           $ resolvectl query www.0pointer.net
246           www.0pointer.net: 2a01:238:43ed:c300:10c3:bcf3:3266:da74
247                             85.214.157.71
248
249           -- Information acquired via protocol DNS in 611.6ms.
250           -- Data is authenticated: no
251
252       Example 2. Retrieve the domain of the "85.214.157.71" IP address
253
254           $ resolvectl query 85.214.157.71
255           85.214.157.71: gardel.0pointer.net
256
257           -- Information acquired via protocol DNS in 1.2997s.
258           -- Data is authenticated: no
259
260       Example 3. Retrieve the MX record of the "yahoo.com" domain
261
262           $ resolvectl --legend=no -t MX query yahoo.com
263           yahoo.com. IN MX    1 mta7.am0.yahoodns.net
264           yahoo.com. IN MX    1 mta6.am0.yahoodns.net
265           yahoo.com. IN MX    1 mta5.am0.yahoodns.net
266
267       Example 4. Resolve an SRV service
268
269           $ resolvectl service _xmpp-server._tcp gmail.com
270           _xmpp-server._tcp/gmail.com: alt1.xmpp-server.l.google.com:5269 [priority=20, weight=0]
271                                        173.194.210.125
272                                        alt4.xmpp-server.l.google.com:5269 [priority=20, weight=0]
273                                        173.194.65.125
274                                        ...
275
276       Example 5. Retrieve a PGP key
277
278           $ resolvectl openpgp zbyszek@fedoraproject.org
279           d08ee310438ca124a6149ea5cc21b6313b390dce485576eff96f8722._openpgpkey.fedoraproject.org. IN OPENPGPKEY
280                   mQINBFBHPMsBEACeInGYJCb+7TurKfb6wGyTottCDtiSJB310i37/6ZYoeIay/5soJjlMyf
281                   MFQ9T2XNT/0LM6gTa0MpC1st9LnzYTMsT6tzRly1D1UbVI6xw0g0vE5y2Cjk3xUwAynCsSs
282                   ...
283
284       Example 6. Retrieve a TLS key ("tcp" and ":443" could be skipped)
285
286           $ resolvectl tlsa tcp fedoraproject.org:443
287           _443._tcp.fedoraproject.org IN TLSA 0 0 1 19400be5b7a31fb733917700789d2f0a2471c0c9d506c0e504c06c16d7cb17c0
288                   -- Cert. usage: CA constraint
289                   -- Selector: Full Certificate
290                   -- Matching type: SHA-256
291

SEE ALSO

293       systemd(1), systemd-resolved.service(8), systemd.dnssd(5), systemd-
294       networkd.service(8), resolvconf(8)
295

NOTES

297        1. Link-Local Multicast Name Resolution
298           https://tools.ietf.org/html/rfc4795
299
300        2. Multicast DNS
301           https://www.ietf.org/rfc/rfc6762.txt
302
303        3. DNS-SD
304           https://tools.ietf.org/html/rfc6763
305
306        4. SRV
307           https://tools.ietf.org/html/rfc2782
308
309        5. OPENPGPKEY
310           https://tools.ietf.org/html/rfc7929
311
312        6. TLSA
313           https://tools.ietf.org/html/rfc6698
314
315
316
317systemd 243                                                      RESOLVECTL(1)
Impressum