dnsconfd.conf - Man Page

Dnsconfd.conf is YAML formatted configuration file altering behaviour of Dnsconfd.

log_level

Log level of dnsconfd, default INFO

resolv_conf_path

Path to resolv.conf that the dnsconfd should manage, default /etc/resolv.conf

prioritize_wire

If set to yes then wireless interfaces will have lower priority, default yes

listen_address

Address on which local resolver listens, default 127.0.0.1

resolver_options

Options to be used in resolv.conf for alteration of resolver, default "edns0 trust-ad"

dnssec_enabled

Enable dnssec record validation, default no

stderr_log

Dnsconfd will write logs into stderr, default yes

syslog_log

Dnsconfd will use syslog for logging, default no

file_log

Dnsconfd will write logs into specified file, not used by default

static_servers

List of servers that should be configured, default is empty

certification_authority

Space separated list of CA bundles used for encrypted protocols as default when no custom CA was specified. The first one that can be accessed will be used, default /etc/pki/dns/extracted/pem/tls-ca-bundle.pem /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

rpz

List of Response Policy Zones to be loaded via DNS zone transfer (AXFR/IXFR). Each zone is kept synchronized with its remote master automatically by Unbound. When at least one RPZ zone is configured, the respip module is loaded into Unbound. Default is empty (no RPZ zones).

Available attributes of RPZ zones are:

· name required, the name of the RPZ authority zone
· master optional, IP address of the server to transfer the zone from
· zonefile optional, path where the zone is stored locally. If a master is configured, the zonefile must be located in a directory writable by the underlying DNS resolver so that zone transfers can be saved.

At least one of master or zonefile must be specified.

Examples:

Configuring a single RPZ zone with zone transfer

rpz:
 - name: rpz.example.com
   master: 192.0.2.1

Available attributes of servers are:

· address required, string of servers ip address
· protocol optional, DoT or plain
· name optional, name that should be present in server's TLS certificate
· port optional, port on which server is listening. If not given then 53 is used for plain protocol and 853 for DoT
· routing_domains optional, domains whose resolution should be performed through this server
· search_domains optional, domains that should be used for host-name lookup
· dnssec optional, boolean indicating whether this server supports dnssec or not
· networks optional, networks whose reverse dns records must be resolved by this server
· priority optional, integer indicating priority of the server

Examples:

Enabling one global server using DNS over TLS

static_servers:
  - address: 192.168.6.3
    protocol: "dns+tls"
    name: named

Enabling one server for specific domain and second for everything else

static_servers:
   - address: 192.168.6.3
   - address: 192.168.6.4
     routing_domains:
       - example.com

The include directive allows splitting configuration across multiple files. Its value can be a single path or a list of paths. Each path may be a file, a directory, or a glob pattern.

When the path points to a directory, all files matching *.conf inside that directory are included. Glob patterns (e.g. /etc/dnsconfd/conf.d/*.conf) are expanded in the usual way. If a glob pattern matches nothing, it is silently ignored.

Included files are parsed in order and their values are merged into the configuration. A maximum of 1000 files may be included in total; exceeding this limit causes an error, which protects against include cycles.

Relative paths are resolved against the current working directory of the dnsconfd process, not against the directory of the file that contains the include directive. Use absolute paths to avoid ambiguity.

Examples:

Including a single file:

include: /etc/dnsconfd/conf.d/custom.conf

Including a list of paths:

include:
 - /etc/dnsconfd/conf.d/
 - /etc/dnsconfd/conf.d/extra/*.conf

Please for reporting bugs use Github repository https://github.com/InfrastructureServices/dnsconfd

dnsconfd(8) Dnsconfd daemon dnsconfd-status(8) Checking status of dnsconfd dnsconfd-reload(8) Reload running cache service dnsconfd-config(8) Change configuration of host dnsconfd-update(8) Change Dnsconfd configuration

Copyright (c) 2023 Red Hat, Inc.

dnsconfd(8), dnsconfd-config(8), dnsconfd-reload(8), dnsconfd-status(8).