Name Server - System DNS Servers

This page describes how to configure system DNS servers (name-server) and the domain search list (domain-search) in VyOS. These settings determine how the VyOS system resolves domain names for all system operations.

Overview

System DNS servers in VyOS are used for:

Resolving domain names for all system processes
Package updates via apt/dpkg
NTP synchronization (when NTP servers are specified by name)
Pulling container images (Docker/Podman)
VPN connections to remote endpoints by name
Sending Syslog to remote servers by name
Monitoring and alerting systems
API calls to external services

Important Notes

Difference from DNS forwarding:

system name-server - DNS for the VyOS system itself
service dns forwarding - the DNS server that VyOS provides to clients

Configuration priority:

Static system name-server configuration takes precedence over DNS obtained via DHCP
If both are configured, only the static servers are used
DHCP DNS is used only if system name-server is not configured

VRF limitations:

Current VyOS versions have no way to force system DNS traffic through a specific VRF
System DNS queries use the default VRF regardless of management VRF settings

Configuration file:

The DNS configuration is written to /etc/resolv.conf
The file is generated automatically on commit; do not edit it manually
Changes take effect immediately for all system processes

DNS Server Configuration

Basic Setup

IPv4 DNS Servers

# Add the first DNS server
set system name-server 8.8.8.8

# Add the second DNS server (backup)
set system name-server 8.8.4.4

# Apply the configuration
commit
save

IPv6 DNS Servers

# Add an IPv6 DNS server
set system name-server 2001:4860:4860::8888
set system name-server 2001:4860:4860::8844

commit
save

Dual-stack Configuration

# Mixed IPv4 + IPv6 configuration
set system name-server 8.8.8.8
set system name-server 8.8.4.4
set system name-server 2001:4860:4860::8888
set system name-server 2001:4860:4860::8844

commit
save

Multiple DNS Servers

VyOS supports configuring multiple DNS servers. Order matters - the servers are queried sequentially in the order they were added.

# First server - primary (used first)
set system name-server 192.168.1.53

# Second server - backup
set system name-server 192.168.1.54

# Third server - fallback
set system name-server 8.8.8.8

commit
save

Resolver behavior:

If the first server is unavailable, the second one is used automatically
If the second is unavailable, the third one is used
The timeout per server is 5 seconds by default
A maximum of 3 servers is recommended (a /etc/resolv.conf limitation)

Removing DNS Servers

# Remove a specific DNS server
delete system name-server 8.8.4.4

# Remove all DNS servers
delete system name-server

commit
save

Domain Search List

Description

The domain-search (domain search list) defines the suffixes that are automatically appended to incomplete domain names during resolution.

How it works:

When a short name is requested (for example, server1), the system appends the suffixes from the list
Queries are performed sequentially: server1.first-domain.com, server1.second-domain.com, and so on
The search stops as soon as the first successful resolution is found
Fully qualified domain names (ending with a dot or containing dots) are not modified

RFC limits:

Maximum of 6 domains in the list
Each domain: maximum of 253 characters
Allowed characters: letters, digits, hyphens, dots
A domain cannot start or end with a hyphen

Configuration

Basic Setup

# Add the first search domain
set system domain-search vyos.io

# Add additional domains
set system domain-search vyos.net
set system domain-search vyos.network

commit
save

Result in /etc/resolv.conf

# After applying the configuration:
# nameserver 8.8.8.8
# nameserver 8.8.4.4
# search vyos.io vyos.net vyos.network

Verification

# With domain-search set to: example.com

# Query a short name
vyos@router:~$ ping server1
# The system tries: server1.example.com

# Query with a trailing dot (FQDN) - no suffix is appended
vyos@router:~$ ping server1.other-domain.org.
# The system queries: server1.other-domain.org (unchanged)

# Query a full name (containing dots) - a suffix is appended
vyos@router:~$ ping server1.local
# The system tries: server1.local.example.com, then server1.local

Removing domain-search

# Remove a specific domain
delete system domain-search vyos.network

# Remove all domains
delete system domain-search

commit
save

DNS Configuration Priority

Static vs DHCP Configuration

VyOS supports obtaining DNS servers via DHCP on WAN interfaces, but static configuration takes precedence.

Behavior:

If static system name-server entries are configured, only they are used
If no static servers are configured, DNS from DHCP is used
If DHCP does not provide DNS and there are no static entries, the system uses the built-in fallback (127.0.0.1 for the local DNS cache, if enabled)

Example 1: Static servers only

# Static configuration
set system name-server 8.8.8.8
set system name-server 8.8.4.4

# DHCP on the WAN interface (provides DNS, but it is ignored)
set interfaces ethernet eth0 address dhcp

commit
save

# Result: only 8.8.8.8 and 8.8.4.4 are used

Example 2: DHCP servers only

# No static name-server configuration

# DHCP on the WAN interface (provides DNS)
set interfaces ethernet eth0 address dhcp

commit
save

# Result: the DNS servers obtained via DHCP are used

Example 3: Hybrid configuration (does not work as expected)

# MISTAKE: Attempting to combine static and DHCP DNS
set system name-server 8.8.8.8
set interfaces ethernet eth0 address dhcp

# Result: only 8.8.8.8 is used, DHCP DNS is ignored

Recommendation:

For production systems, use static DNS servers only
Reserve DHCP DNS for temporary or test configurations
Do not mix the two approaches - it leads to confusion

Overriding DHCP DNS

If you need to use static DNS instead of DHCP:

# Disable obtaining DNS via DHCP on the interface
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 dhcp-options no-default-route
set interfaces ethernet eth0 dhcp-options reject nameserver

# Configure static DNS
set system name-server 8.8.8.8
set system name-server 8.8.4.4

commit
save

Note: The reject nameserver option may not be available in some VyOS versions. In that case, simply configure static servers - they will take precedence.

Cloud Providers

Yandex Cloud

Yandex Cloud provides internal DNS servers for resolving the internal names of virtual machines and services.

Using the Yandex Cloud Internal DNS

# Yandex Cloud internal DNS server (the second IP in the subnet)
# For the subnet 10.128.0.0/24 this is 10.128.0.2
set system name-server 10.128.0.2

commit
save

How it works:

Each subnet in Yandex Cloud has a built-in DNS server at the second IP address
For the subnet 10.128.0.0/24 the DNS is: 10.128.0.2
For the subnet 192.168.1.0/24 the DNS is: 192.168.1.2
It resolves internal FQDNs of virtual machines: vm-name.auto.internal

Using Yandex Public DNS

# Yandex public DNS servers (77.88.8.8)
set system name-server 77.88.8.8
set system name-server 77.88.8.1

commit
save

Yandex DNS characteristics:

Addresses: 77.88.8.8, 77.88.8.1
DNSSEC support
Malicious site filtering (optional)
Low latency for clients in Russia

Hybrid Yandex Cloud Configuration

# Internal DNS for local names + public DNS for the internet
set system name-server 10.128.0.2
set system name-server 77.88.8.8
set system name-server 77.88.8.1

# Domain-search for internal names
set system domain-search auto.internal
set system domain-search ru-central1.internal

commit
save

Complete Configuration Example for Yandex Cloud

configure

# Hostname
set system host-name vyos-gateway-ru-central1-a
set system domain-name ru-central1.internal

# DNS configuration
# First - Yandex Cloud internal DNS (resolves *.auto.internal)
set system name-server 10.128.0.2

# Second - Yandex public DNS (for external names)
set system name-server 77.88.8.8

# Third - backup public DNS
set system name-server 77.88.8.1

# Domain search for automatically appending suffixes
set system domain-search ru-central1.internal
set system domain-search auto.internal

# NTP servers (to verify DNS resolution)
set service ntp server ntp1.yandex.ru
set service ntp server ntp2.yandex.ru

commit
save
exit

Verification:

# Check internal resolution
vyos@vyos-gateway-ru-central1-a:~$ nslookup vm-name.auto.internal
# Should resolve via 10.128.0.2

# Check external resolution
vyos@vyos-gateway-ru-central1-a:~$ nslookup google.com
# Should resolve via 77.88.8.8

# Check the configuration
vyos@vyos-gateway-ru-central1-a:~$ cat /etc/resolv.conf
# nameserver 10.128.0.2
# nameserver 77.88.8.8
# nameserver 77.88.8.1
# search ru-central1.internal auto.internal

VK Cloud (Cloud.ru)

VK Cloud provides internal DNS servers for resolving virtual machines within a project.

Using the VK Cloud Internal DNS

# VK Cloud internal DNS server (the second IP in the subnet)
# For the subnet 10.0.0.0/24 this is 10.0.0.2
set system name-server 10.0.0.2

commit
save

How it works:

Similar to Yandex Cloud, each subnet has a DNS server at the second IP
It resolves internal FQDNs of virtual machines
FQDN format: vm-name.mcs.local or vm-name.cloud.local

Using VK Cloud Public DNS

VK Cloud does not provide public DNS servers. It is recommended to use:

# Google DNS
set system name-server 8.8.8.8
set system name-server 8.8.4.4

# Or Cloudflare DNS
set system name-server 1.1.1.1
set system name-server 1.0.0.1

# Or Yandex DNS
set system name-server 77.88.8.8
set system name-server 77.88.8.1

commit
save

Complete Configuration Example for VK Cloud

configure

# Hostname
set system host-name vyos-gateway-msk1
set system domain-name msk1.cloud.vk.com

# DNS configuration
# VK Cloud internal DNS (resolves local VMs)
set system name-server 10.0.0.2

# Public DNS for external names
set system name-server 8.8.8.8
set system name-server 8.8.4.4

# Domain search
set system domain-search msk1.cloud.vk.com
set system domain-search mcs.local

# NTP
set service ntp server 0.ru.pool.ntp.org
set service ntp server 1.ru.pool.ntp.org

commit
save
exit

AWS (Amazon Web Services)

AWS provides an internal DNS resolver for every VPC.

Using the Amazon Route 53 Resolver

# Amazon Route 53 Resolver (VPC DNS)
# Always available at IP: <VPC_CIDR_BASE> + 2
# For the VPC 10.0.0.0/16 this is 10.0.0.2
set system name-server 10.0.0.2

commit
save

How it works:

DNS address: <VPC_CIDR_BASE> + 2
Resolves internal EC2 names: ip-10-0-1-5.ec2.internal
Resolves Route 53 Private Hosted Zones
Forwards public queries to the internet

Example for AWS

configure

# Hostname
set system host-name vyos-gateway-us-east-1a
set system domain-name us-east-1.compute.internal

# DNS configuration
set system name-server 10.0.0.2

# Domain search for EC2
set system domain-search us-east-1.compute.internal
set system domain-search ec2.internal

# NTP (AWS Time Sync Service)
set service ntp server 169.254.169.123

commit
save
exit

Azure (Microsoft Azure)

Azure provides built-in DNS for every virtual network environment.

Using Azure DNS

# Azure Virtual Network DNS
# Address: 168.63.129.16 (special Azure metadata IP)
set system name-server 168.63.129.16

commit
save

How it works:

Address: 168.63.129.16 (used for all VNets)
Resolves internal Azure VM names
Supports Azure Private DNS Zones
Forwards public queries

Example for Azure

configure

# Hostname
set system host-name vyos-gateway-westeurope
set system domain-name internal.cloudapp.net

# DNS configuration
set system name-server 168.63.129.16

# Domain search
set system domain-search internal.cloudapp.net

# NTP (Azure NTP)
set service ntp server time.windows.com

commit
save
exit

Google Cloud Platform (GCP)

GCP provides an internal DNS resolver for every VPC network.

Using Google Cloud DNS

# Google Cloud DNS (metadata server)
set system name-server 169.254.169.254

# Or use the internal VPC DNS
# For the subnet 10.128.0.0/20 this is 10.128.0.2
set system name-server 10.128.0.2

commit
save

How it works:

Metadata DNS: 169.254.169.254
VPC DNS: <SUBNET_CIDR_BASE> + 2
Resolves internal GCP VM names: vm-name.c.project-id.internal
Supports Cloud DNS Private Zones

Example for GCP

configure

# Hostname
set system host-name vyos-gateway-europe-west1-b
set system domain-name c.my-project-id.internal

# DNS configuration
set system name-server 169.254.169.254
set system name-server 10.128.0.2

# Domain search
set system domain-search c.my-project-id.internal

# NTP (Google Public NTP)
set service ntp server time.google.com

commit
save
exit

Configuration Examples

Example 1: Corporate Network with Internal DNS

Goal: Configure VyOS to use corporate DNS with public backup servers.

configure

# DNS configuration
# Primary corporate DNS (Active Directory)
set system name-server 192.168.1.10

# Backup corporate DNS
set system name-server 192.168.1.11

# Public backup (in case the corporate servers fail)
set system name-server 8.8.8.8

# Domain search for corporate domains
set system domain-search corp.example.com
set system domain-search example.com

# Hostname
set system host-name vyos-gateway
set system domain-name corp.example.com

commit
save
exit

Verification:

# Check resolution of corporate names
nslookup dc01
# Should resolve as dc01.corp.example.com via 192.168.1.10

# Check resolution of external names
nslookup google.com
# Should resolve via the corporate DNS

# Check the configuration
cat /etc/resolv.conf

Example 2: Edge Router with Public DNS

Goal: Configure an edge router with reliable public DNS.

configure

# DNS configuration with multiple providers
# Google DNS
set system name-server 8.8.8.8
set system name-server 8.8.4.4

# Cloudflare DNS
set system name-server 1.1.1.1

# Hostname
set system host-name vyos-edge-router
set system domain-name edge.local

commit
save
exit

Example 3: Multi-site with Conditional Forwarding

Goal: A headquarters with branch offices, where each branch has its own DNS domain.

configure

# Main office (Moscow)
set system host-name vyos-hq-moscow
set system domain-name moscow.corp.local

# DNS servers
# Local DNS (resolves moscow.corp.local)
set system name-server 192.168.1.53

# Headquarters DNS (resolves corp.local and the branches)
set system name-server 10.0.0.53

# Public backup
set system name-server 8.8.8.8

# Domain search for all branches
set system domain-search moscow.corp.local
set system domain-search spb.corp.local
set system domain-search ekb.corp.local
set system domain-search corp.local

commit
save
exit

Branch (Saint Petersburg):

configure

set system host-name vyos-branch-spb
set system domain-name spb.corp.local

# Branch local DNS
set system name-server 192.168.2.53

# Headquarters DNS over VPN
set system name-server 10.0.0.53

# Public backup
set system name-server 8.8.8.8

# Domain search
set system domain-search spb.corp.local
set system domain-search corp.local

commit
save
exit

Example 4: DMZ with Restricted DNS

Goal: A DMZ router that should resolve only specific domains.

configure

set system host-name vyos-dmz
set system domain-name dmz.example.com

# DNS server with a whitelist for the DMZ
set system name-server 10.10.10.53

# Public backup (restricted by firewall rules)
set system name-server 8.8.8.8

# Domain search for the DMZ only
set system domain-search dmz.example.com

commit
save
exit

Example 5: IPv6-only Network

Goal: Configure DNS for an IPv6-only infrastructure.

configure

set system host-name vyos-ipv6-router
set system domain-name ipv6.example.com

# Google DNS (IPv6)
set system name-server 2001:4860:4860::8888
set system name-server 2001:4860:4860::8844

# Cloudflare DNS (IPv6)
set system name-server 2606:4700:4700::1111
set system name-server 2606:4700:4700::1001

# Domain search
set system domain-search ipv6.example.com

commit
save
exit

Example 6: Dual-stack with IPv6 Priority

Goal: A dual-stack network that prefers IPv6 for DNS.

configure

set system host-name vyos-dualstack
set system domain-name dualstack.example.com

# IPv6 DNS servers (priority - listed first)
set system name-server 2001:4860:4860::8888
set system name-server 2001:4860:4860::8844

# IPv4 DNS servers (fallback)
set system name-server 8.8.8.8
set system name-server 8.8.4.4

# Domain search
set system domain-search dualstack.example.com

commit
save
exit

Verification and Monitoring Commands

Checking the DNS Configuration

# Show the configured DNS servers
show configuration system name-server

# Show domain-search
show configuration system domain-search

# Show the entire system configuration
show configuration system

Checking /etc/resolv.conf

# View the current contents of resolv.conf
cat /etc/resolv.conf

# Example output:
# nameserver 8.8.8.8
# nameserver 8.8.4.4
# search vyos.io vyos.net

Testing DNS Resolution

Basic Commands

# DNS lookup with nslookup
nslookup google.com

# Output:
# Server:         8.8.8.8
# Address:        8.8.8.8#53
#
# Non-authoritative answer:
# Name:   google.com
# Address: 142.250.185.46

# DNS lookup with dig
dig google.com

# Concise information
dig google.com +short

# Query a specific DNS server
dig @8.8.8.8 google.com

# DNS lookup with host
host google.com

# Reverse DNS lookup
host 8.8.8.8

Checking domain-search

# With domain-search set to: example.com

# Query a short name (a suffix should be appended)
dig server1

# The output will show: server1.example.com

# Check with verbose search
dig +search server1

Tracing DNS Queries

# Full trace of DNS resolution
dig +trace google.com

# Output:
# . 86400 IN NS a.root-servers.net.
# ...
# google.com. 172800 IN NS ns1.google.com.
# ...
# google.com. 300 IN A 142.250.185.46

Checking DNSSEC

# Check DNSSEC signatures
dig google.com +dnssec

# Check DNSSEC validity
dig google.com +dnssec +multiline

Monitoring DNS Performance

# Measure resolution time
time nslookup google.com

# Output:
# real    0m0.045s
# user    0m0.012s
# sys     0m0.008s

# DNS query statistics with dig
dig google.com +stats

# The output includes:
# ;; Query time: 45 msec
# ;; SERVER: 8.8.8.8#53(8.8.8.8)
# ;; WHEN: Wed Jan 15 10:30:45 MSK 2025
# ;; MSG SIZE  rcvd: 55

Checking DNS Server Availability

# Ping the DNS server
ping -c 4 8.8.8.8

# Check UDP port 53
nc -vuz 8.8.8.8 53

# Or with nmap
nmap -sU -p 53 8.8.8.8

Checking DNS for a Specific Domain

# Query all DNS records
dig example.com ANY

# Query specific record types
dig example.com A      # IPv4 address
dig example.com AAAA   # IPv6 address
dig example.com MX     # Mail exchange
dig example.com NS     # Name servers
dig example.com TXT    # Text records
dig example.com SOA    # Start of authority

Checking Reverse DNS

# Reverse lookup (PTR record)
dig -x 8.8.8.8

# Or with host
host 8.8.8.8

# Or with nslookup
nslookup 8.8.8.8

Logging DNS Queries

# Enable DNS debug logging (temporarily)
sudo tcpdump -i any port 53 -vv

# Log DNS queries to a file
sudo tcpdump -i any port 53 -w /tmp/dns-traffic.pcap

# Analyze the saved file
sudo tcpdump -r /tmp/dns-traffic.pcap -vv

Checking the DNS Cache

# VyOS has no built-in system-level DNS cache
# But if dns forwarding is enabled, you can check its cache

# Show dns forwarding statistics (if configured)
show dns forwarding statistics

# Clear the dns forwarding cache (if configured)
reset dns forwarding cache

Troubleshooting

Problem 1: DNS Does Not Resolve Names

Symptoms:

The nslookup, dig, and host commands return errors
The system cannot update packages via apt update
NTP does not synchronize (when NTP servers are specified by name)

Diagnostics:

# Check the DNS configuration
show configuration system name-server

# Check /etc/resolv.conf
cat /etc/resolv.conf

# Check DNS server availability
ping 8.8.8.8

# Check UDP port 53
nc -vuz 8.8.8.8 53

# Check DNS resolution
nslookup google.com

Solution:

# If no DNS servers are configured - configure them
configure
set system name-server 8.8.8.8
set system name-server 8.8.4.4
commit
save
exit

# Check firewall rules (DNS must be allowed)
show firewall

# Add a rule if DNS is being blocked
configure
set firewall name WAN_LOCAL rule 100 action accept
set firewall name WAN_LOCAL rule 100 protocol udp
set firewall name WAN_LOCAL rule 100 destination port 53
commit
save
exit

# Check the result
nslookup google.com

Problem 2: Slow DNS Resolution

Symptoms:

DNS commands take several seconds
Web browsing is slow
SSH connections take a long time to establish

Diagnostics:

# Measure resolution time
time nslookup google.com

# Check the RTT to the DNS servers
ping -c 10 8.8.8.8

# Check dig statistics
dig google.com +stats

# Trace the route to the DNS server
traceroute 8.8.8.8

Solution:

# Use faster or closer DNS servers
configure

# Remove the slow servers
delete system name-server 8.8.8.8

# Add fast local servers
set system name-server 192.168.1.53  # Local DNS
set system name-server 77.88.8.8     # Yandex DNS (for Russia)

commit
save
exit

# Check the improvement
time nslookup google.com

Problem 3: Domain-search Does Not Work

Symptoms:

Short names do not resolve
You have to specify full FQDNs

Diagnostics:

# Check the domain-search configuration
show configuration system domain-search

# Check /etc/resolv.conf
cat /etc/resolv.conf | grep search

# Test query
dig +search server1

Solution:

# Configure domain-search
configure
set system domain-search example.com
commit
save
exit

# Check /etc/resolv.conf
cat /etc/resolv.conf
# There should be a line: search example.com

# Test query
dig server1
# Should resolve as server1.example.com

Problem 4: DNS Resolves Only IPv6 or Only IPv4

Symptoms:

Dual-stack names resolve to only one address type
No A or AAAA records

Diagnostics:

# Check IPv4 resolution
dig google.com A

# Check IPv6 resolution
dig google.com AAAA

# Check both
dig google.com A AAAA

Solution:

# Make sure you are using DNS servers that support both protocols
configure

# For dual-stack, use modern DNS
set system name-server 8.8.8.8
set system name-server 2001:4860:4860::8888

commit
save
exit

# Check both record types
dig google.com A
dig google.com AAAA

Problem 5: Conflict Between Static and DHCP DNS

Symptoms:

DNS servers change after a reboot
/etc/resolv.conf contains unexpected servers

Diagnostics:

# Check the static configuration
show configuration system name-server

# Check the DHCP configuration on the interfaces
show configuration interfaces ethernet

# Check /etc/resolv.conf
cat /etc/resolv.conf

Solution:

# Option 1: Use static DNS only
configure
set system name-server 8.8.8.8
set system name-server 8.8.4.4
commit
save
exit

# Option 2: Use DHCP DNS only
configure
delete system name-server
commit
save
exit

# Option 3: Disable DHCP DNS on the interface (if supported)
configure
set interfaces ethernet eth0 dhcp-options no-default-route
commit
save
exit

Problem 6: DNS Does Not Resolve Internal Cloud Names

Symptoms:

External names resolve, but internal ones (*.auto.internal, *.ec2.internal) do not
Public DNS is used instead of the cloud DNS

Diagnostics:

# Check the DNS configuration
show configuration system name-server

# Try to resolve an internal name
nslookup vm-name.auto.internal

# Check which DNS server is being used
dig vm-name.auto.internal

Solution (Yandex Cloud):

configure

# Add the Yandex Cloud internal DNS first
set system name-server 10.128.0.2

# Then the public ones
set system name-server 77.88.8.8

# Domain-search for internal names
set system domain-search auto.internal
set system domain-search ru-central1.internal

commit
save
exit

# Check
nslookup vm-name.auto.internal

Solution (AWS):

configure

# Use the VPC DNS
set system name-server 10.0.0.2

# Domain-search for EC2
set system domain-search us-east-1.compute.internal
set system domain-search ec2.internal

commit
save
exit

# Check
nslookup ip-10-0-1-5.ec2.internal

Problem 7: VRF Routing for DNS Does Not Work

Symptoms:

A management VRF is configured, but DNS traffic goes through the default VRF
DNS is unreachable in the isolated VRF

Explanation:

Current VyOS versions have no way to route system DNS traffic through a specific VRF. This is a known limitation.

Workaround:

# Option 1: Use a DNS server reachable from the default VRF
configure
set system name-server 8.8.8.8  # Public DNS via the default route
commit
save
exit

# Option 2: Configure a static route for the DNS server
configure
set protocols static route 192.168.1.53/32 next-hop 10.0.0.1
commit
save
exit

# Option 3: Use DNS forwarding with source-address
# (allows specifying the source IP for queries)
configure
set service dns forwarding listen-address 127.0.0.1
set service dns forwarding name-server 192.168.1.53
set service dns forwarding source-address 10.0.0.10
commit
save
exit

# Change system name-server to localhost
configure
set system name-server 127.0.0.1
commit
save
exit

Problem 8: DNSSEC Validation Does Not Work

Symptoms:

DNSSEC-signed domains do not resolve
DNSSEC validation errors

Diagnostics:

# Check DNSSEC validation
dig google.com +dnssec

# Check whether the DNS server supports DNSSEC
dig @8.8.8.8 . DNSKEY

Solution:

# Use DNS servers with DNSSEC support
configure

# Google DNS (supports DNSSEC)
set system name-server 8.8.8.8

# Cloudflare DNS (supports DNSSEC)
set system name-server 1.1.1.1

# Yandex DNS (supports DNSSEC)
set system name-server 77.88.8.8

commit
save
exit

# Check DNSSEC
dig google.com +dnssec

Best Practices

1. Choosing DNS Servers

Use at least 2 DNS servers:

# Good: 2-3 servers
set system name-server 8.8.8.8
set system name-server 8.8.4.4

# Bad: only one server
set system name-server 8.8.8.8

Choose servers with a low RTT:

# Check the RTT
ping -c 10 8.8.8.8
ping -c 10 77.88.8.8
ping -c 10 1.1.1.1

# Use the server with the lowest RTT
# For Russia, typically:
set system name-server 77.88.8.8  # Yandex, ~5-10ms
set system name-server 8.8.8.8    # Google, ~20-30ms

Combine different providers:

# Diversify DNS providers
set system name-server 77.88.8.8   # Yandex
set system name-server 8.8.8.8     # Google
set system name-server 1.1.1.1     # Cloudflare

2. Cloud Infrastructures

Always list the internal cloud DNS first:

# Yandex Cloud
set system name-server 10.128.0.2   # Internal DNS
set system name-server 77.88.8.8    # Public backup

# AWS
set system name-server 10.0.0.2     # VPC DNS
set system name-server 8.8.8.8      # Public backup

# Azure
set system name-server 168.63.129.16  # Azure DNS
set system name-server 8.8.8.8        # Public backup

Configure domain-search for internal names:

# Yandex Cloud
set system domain-search auto.internal
set system domain-search ru-central1.internal

# AWS
set system domain-search us-east-1.compute.internal
set system domain-search ec2.internal

3. Corporate Networks

Prioritize internal DNS:

# Corporate DNS first (resolves internal.corp.com)
set system name-server 192.168.1.10

# Corporate backup
set system name-server 192.168.1.11

# Public DNS only as a last resort
set system name-server 8.8.8.8

Use domain-search for convenience:

set system domain-search corp.example.com
set system domain-search example.com

# Lets you use:
# ping dc01 -> dc01.corp.example.com
# ping exchange -> exchange.corp.example.com

4. Security

Use only trusted DNS servers:

# Good: well-known public DNS
set system name-server 8.8.8.8     # Google
set system name-server 1.1.1.1     # Cloudflare
set system name-server 77.88.8.8   # Yandex

# Bad: random unknown DNS
set system name-server 123.45.67.89

Consider DNS over TLS/HTTPS for privacy:

Note: VyOS does not support DoT/DoH directly via system name-server, but you can configure it through dns forwarding or an external DNS proxy.

# Option with dns forwarding (requires additional steps)
set service dns forwarding listen-address 127.0.0.1
set service dns forwarding name-server 1.1.1.1
# Additional DoH setup requires manual configuration

set system name-server 127.0.0.1

Monitor DNS traffic:

# Periodically check DNS queries
sudo tcpdump -i any port 53 -c 100

# Look for suspicious queries

5. Performance

Minimize latency:

# Check the RTT to various DNS servers
ping -c 10 8.8.8.8
ping -c 10 77.88.8.8
ping -c 10 1.1.1.1

# Use the fastest ones

Limit the number of domain-search entries:

# Good: 1-3 domains
set system domain-search corp.local
set system domain-search local

# Bad: too many domains (slows down resolution)
set system domain-search domain1.com
set system domain-search domain2.com
set system domain-search domain3.com
set system domain-search domain4.com
set system domain-search domain5.com
set system domain-search domain6.com

Use a local DNS cache:

# Configure dns forwarding as a local cache
set service dns forwarding listen-address 127.0.0.1
set service dns forwarding cache-size 10000
set service dns forwarding name-server 8.8.8.8
set service dns forwarding name-server 8.8.4.4

# Change system name-server to localhost
set system name-server 127.0.0.1

commit
save

6. Redundancy

DNS server redundancy:

# Minimum of 2, 3 recommended
set system name-server 192.168.1.10
set system name-server 192.168.1.11
set system name-server 8.8.8.8

Geographic redundancy:

# DNS servers in different data centers
set system name-server 10.0.1.53   # DC1
set system name-server 10.1.1.53   # DC2
set system name-server 8.8.8.8     # Public backup

7. Monitoring and Alerting

Check DNS regularly:

# DNS monitoring script
sudo tee /config/scripts/dns-monitor.sh > /dev/null <<'EOF'
#!/bin/bash
# DNS resolution monitoring

DNS_SERVERS="8.8.8.8 8.8.4.4"
TEST_DOMAIN="google.com"
TIMEOUT=5

for server in $DNS_SERVERS; do
    response=$(dig @$server $TEST_DOMAIN +time=$TIMEOUT +tries=1 +short 2>&1)
    if [ $? -eq 0 ] && [ -n "$response" ]; then
        echo "DNS $server: OK"
        logger -t dns-monitor "DNS $server: OK"
    else
        echo "DNS $server: FAILED"
        logger -t dns-monitor "ERROR: DNS $server FAILED"
        # Send an alert
    fi
done
EOF

chmod +x /config/scripts/dns-monitor.sh

# Schedule a check every 5 minutes
set system task-scheduler task dns-monitor interval '*/5 * * * *'
set system task-scheduler task dns-monitor executable path '/config/scripts/dns-monitor.sh'

commit
save

Alerting on DNS loss:

# Integration with a monitoring system
# For example, sending to syslog for SIEM analysis
set system syslog host 10.0.0.100 facility local7 level warning

8. Documentation

Document your DNS server choices:

# Add comments to the configuration
configure
set system name-server 192.168.1.10
set system name-server 192.168.1.11
set system name-server 8.8.8.8

commit comment "DNS: 192.168.1.10/11 - corporate AD DNS, 8.8.8.8 - backup"
save

Keep a change history:

# View the DNS change history
show system commit

# Compare configurations
show system commit diff 10

9. IPv6 Ready

Support dual-stack:

# IPv4 + IPv6 DNS servers
set system name-server 8.8.8.8
set system name-server 8.8.4.4
set system name-server 2001:4860:4860::8888
set system name-server 2001:4860:4860::8844

commit
save

10. Testing and Validation

Test DNS after changes:

# Always test after changing the DNS configuration
nslookup google.com
nslookup internal-server.corp.local
ping -c 4 ntp.pool.org

# Check the resolution time
time nslookup google.com

# Check domain-search
dig +search server1

Integration with Other VyOS Services

NTP

DNS is used to resolve NTP servers specified by name:

configure

# DNS for resolving NTP servers
set system name-server 8.8.8.8
set system name-server 8.8.4.4

# NTP servers by name (require DNS resolution)
set service ntp server 0.pool.ntp.org
set service ntp server 1.pool.ntp.org

commit
save
exit

# Verify that the NTP servers resolve
nslookup 0.pool.ntp.org
show ntp

Syslog

DNS is used to resolve remote syslog servers:

configure

# DNS configuration
set system name-server 8.8.8.8

# Syslog server by name
set system syslog host syslog.corp.local facility all level info
set system syslog host syslog.corp.local protocol tcp
set system syslog host syslog.corp.local port 514

commit
save
exit

# Verify resolution of the syslog server
nslookup syslog.corp.local

DNS Forwarding

System name-server can be used together with dns forwarding:

configure

# System DNS (for the VyOS system itself)
set system name-server 8.8.8.8
set system name-server 8.8.4.4

# DNS Forwarding (for LAN clients)
set service dns forwarding listen-address 192.168.1.1
set service dns forwarding name-server 8.8.8.8
set service dns forwarding name-server 8.8.4.4

commit
save
exit

The difference:

system name-server - used by the VyOS system itself
service dns forwarding name-server - upstream servers for clients

VPN

DNS is used to resolve remote VPN endpoints:

configure

# DNS configuration
set system name-server 8.8.8.8

# IPsec VPN with a peer by name
set vpn ipsec site-to-site peer vpn-gateway.example.com
set vpn ipsec site-to-site peer vpn-gateway.example.com authentication mode pre-shared-secret
set vpn ipsec site-to-site peer vpn-gateway.example.com authentication pre-shared-secret secret123

commit
save
exit

# Verify resolution of the VPN peer
nslookup vpn-gateway.example.com

Containers

DNS is used to pull container images:

configure

# DNS configuration
set system name-server 8.8.8.8

# Container with an image from a registry by name
set container name nginx image docker.io/nginx:latest

commit
save
exit

# Verify resolution of the registry
nslookup docker.io

Automation Scripts

DNS Health Check Script

sudo tee /config/scripts/dns-health-check.sh > /dev/null <<'EOF'
#!/bin/bash
# DNS Health Check Script

# Parameters
TEST_DOMAINS="google.com cloudflare.com yandex.ru"
DNS_SERVERS=$(grep ^nameserver /etc/resolv.conf | awk '{print $2}')
TIMEOUT=5

echo "=== DNS Health Check ==="
echo "Date: $(date)"
echo ""

# Check each DNS server
for dns in $DNS_SERVERS; do
    echo "Testing DNS server: $dns"

    # Check DNS server availability
    if ping -c 1 -W 1 $dns > /dev/null 2>&1; then
        echo "  [OK] DNS server is reachable"
    else
        echo "  [FAIL] DNS server is unreachable"
        continue
    fi

    # Check resolution of the test domains
    for domain in $TEST_DOMAINS; do
        start=$(date +%s%N)
        result=$(dig @$dns $domain +time=$TIMEOUT +tries=1 +short 2>&1)
        end=$(date +%s%N)

        if [ $? -eq 0 ] && [ -n "$result" ]; then
            duration=$(( ($end - $start) / 1000000 ))
            echo "  [OK] $domain resolved in ${duration}ms"
        else
            echo "  [FAIL] $domain resolution failed"
        fi
    done

    echo ""
done

echo "=== DNS Health Check Complete ==="
EOF

chmod +x /config/scripts/dns-health-check.sh

# Run the check
/config/scripts/dns-health-check.sh

Script for Automatically Selecting the Best DNS

sudo tee /config/scripts/dns-benchmark.sh > /dev/null <<'EOF'
#!/bin/bash
# DNS Benchmark Script

DNS_CANDIDATES="8.8.8.8 8.8.4.4 1.1.1.1 1.0.0.1 77.88.8.8 77.88.8.1"
TEST_DOMAIN="google.com"
TEST_COUNT=10

echo "=== DNS Benchmark ==="

declare -A dns_times

for dns in $DNS_CANDIDATES; do
    echo -n "Testing $dns ... "

    total=0
    success=0

    for i in $(seq 1 $TEST_COUNT); do
        start=$(date +%s%N)
        dig @$dns $TEST_DOMAIN +time=2 +tries=1 +short > /dev/null 2>&1
        if [ $? -eq 0 ]; then
            end=$(date +%s%N)
            duration=$(( ($end - $start) / 1000000 ))
            total=$(( $total + $duration ))
            success=$(( $success + 1 ))
        fi
    done

    if [ $success -gt 0 ]; then
        avg=$(( $total / $success ))
        dns_times[$dns]=$avg
        echo "Average: ${avg}ms (${success}/${TEST_COUNT} success)"
    else
        echo "FAILED"
    fi
done

echo ""
echo "=== Recommended DNS Servers ==="

# Sort by time
for dns in "${!dns_times[@]}"; do
    echo "${dns_times[$dns]} $dns"
done | sort -n | head -3 | while read time dns; do
    echo "set system name-server $dns  # ${time}ms"
done
EOF

chmod +x /config/scripts/dns-benchmark.sh

# Run the benchmark
/config/scripts/dns-benchmark.sh

DNS Configuration Export Script

sudo tee /config/scripts/export-dns-config.sh > /dev/null <<'EOF'
#!/bin/vbash
# Export DNS Configuration to JSON

source /opt/vyatta/etc/functions/script-template

OUTPUT_FILE="/config/dns-config-export.json"

echo "{" > "$OUTPUT_FILE"
echo "  \"timestamp\": \"$(date -Iseconds)\"," >> "$OUTPUT_FILE"
echo "  \"hostname\": \"$(hostname)\"," >> "$OUTPUT_FILE"
echo "  \"name_servers\": [" >> "$OUTPUT_FILE"

# Get the DNS servers
NAMESERVERS=$(grep ^nameserver /etc/resolv.conf | awk '{print $2}')
FIRST=1
for ns in $NAMESERVERS; do
    if [ $FIRST -eq 1 ]; then
        FIRST=0
    else
        echo "," >> "$OUTPUT_FILE"
    fi
    echo -n "    \"$ns\"" >> "$OUTPUT_FILE"
done

echo "" >> "$OUTPUT_FILE"
echo "  ]," >> "$OUTPUT_FILE"
echo "  \"domain_search\": [" >> "$OUTPUT_FILE"

# Get domain-search
SEARCH=$(grep ^search /etc/resolv.conf | sed 's/search //')
FIRST=1
for domain in $SEARCH; do
    if [ $FIRST -eq 1 ]; then
        FIRST=0
    else
        echo "," >> "$OUTPUT_FILE"
    fi
    echo -n "    \"$domain\"" >> "$OUTPUT_FILE"
done

echo "" >> "$OUTPUT_FILE"
echo "  ]" >> "$OUTPUT_FILE"
echo "}" >> "$OUTPUT_FILE"

echo "DNS configuration exported to $OUTPUT_FILE"
cat "$OUTPUT_FILE"
EOF

chmod +x /config/scripts/export-dns-config.sh

# Run the export
/config/scripts/export-dns-config.sh

Additional Resources

Conclusion

Correctly configuring the system DNS servers (name-server) and the domain search list (domain-search) in VyOS is critical for the proper operation of all system components. DNS is used for package updates, time synchronization via NTP, sending logs to remote servers, establishing VPN connections, and many other operations.

Key points:

Redundancy: Always configure at least 2-3 DNS servers for fault tolerance
Performance: Choose DNS servers with a low RTT for your region
Cloud integration: Use internal cloud DNS servers to resolve internal names
Security: Use only trusted DNS servers
Monitoring: Regularly verify that DNS is working
Documentation: Document your DNS server choices and configuration changes

Follow the recommendations in the “Best Practices” section to ensure a reliable and performant DNS infrastructure in your VyOS network.

Reviewed by OpenNix LLC · Last updated on 29 July 2026

LCD Display Option - System Options