# Name Server - System DNS Servers

> Configure system DNS servers and domain-search in VyOS - examples for Yandex Cloud, VK Cloud, and other cloud providers

Source: https://opennix.org/en/docs/vyos/system/vyos-name-server/


## Name Server - System DNS Servers

This page describes how to configure system DNS servers (name-server) and the domain search list (domain-search) in VyOS. These settings determine how the VyOS system resolves domain names for all system operations.

## Overview

System DNS servers in VyOS are used for:

- **Resolving domain names** for all system processes
- **Package updates** via apt/dpkg
- **NTP synchronization** (when NTP servers are specified by name)
- **Pulling container images** (Docker/Podman)
- **VPN connections** to remote endpoints by name
- **Sending Syslog** to remote servers by name
- **Monitoring and alerting** systems
- **API calls** to external services

### Important Notes

**Difference from DNS forwarding:**
- `system name-server` - DNS for the VyOS system itself
- `service dns forwarding` - the DNS server that VyOS provides to clients

**Configuration priority:**
- Static `system name-server` configuration takes precedence over DNS obtained via DHCP
- If both are configured, only the static servers are used
- DHCP DNS is used only if `system name-server` is not configured

**VRF limitations:**
- Current VyOS versions have no way to force system DNS traffic through a specific VRF
- System DNS queries use the default VRF regardless of management VRF settings

**Configuration file:**
- The DNS configuration is written to `/etc/resolv.conf`
- The file is generated automatically on commit; do not edit it manually
- Changes take effect immediately for all system processes

## DNS Server Configuration

### Basic Setup

#### IPv4 DNS Servers

```bash
# Add the first DNS server
set system name-server 8.8.8.8

# Add the second DNS server (backup)
set system name-server 8.8.4.4

# Apply the configuration
commit
save
```

#### IPv6 DNS Servers

```bash
# Add an IPv6 DNS server
set system name-server 2001:4860:4860::8888
set system name-server 2001:4860:4860::8844

commit
save
```

#### Dual-stack Configuration

```bash
# Mixed IPv4 + IPv6 configuration
set system name-server 8.8.8.8
set system name-server 8.8.4.4
set system name-server 2001:4860:4860::8888
set system name-server 2001:4860:4860::8844

commit
save
```

### Multiple DNS Servers

VyOS supports configuring multiple DNS servers. Order matters - the servers are queried sequentially in the order they were added.

```bash
# First server - primary (used first)
set system name-server 192.168.1.53

# Second server - backup
set system name-server 192.168.1.54

# Third server - fallback
set system name-server 8.8.8.8

commit
save
```

**Resolver behavior:**
- If the first server is unavailable, the second one is used automatically
- If the second is unavailable, the third one is used
- The timeout per server is 5 seconds by default
- A maximum of 3 servers is recommended (a `/etc/resolv.conf` limitation)

### Removing DNS Servers

```bash
# Remove a specific DNS server
delete system name-server 8.8.4.4

# Remove all DNS servers
delete system name-server

commit
save
```

## Domain Search List

### Description

The domain-search (domain search list) defines the suffixes that are automatically appended to incomplete domain names during resolution.

**How it works:**
- When a short name is requested (for example, `server1`), the system appends the suffixes from the list
- Queries are performed sequentially: `server1.first-domain.com`, `server1.second-domain.com`, and so on
- The search stops as soon as the first successful resolution is found
- Fully qualified domain names (ending with a dot or containing dots) are not modified

**RFC limits:**
- Maximum of 6 domains in the list
- Each domain: maximum of 253 characters
- Allowed characters: letters, digits, hyphens, dots
- A domain cannot start or end with a hyphen

### Configuration

#### Basic Setup

```bash
# Add the first search domain
set system domain-search vyos.io

# Add additional domains
set system domain-search vyos.net
set system domain-search vyos.network

commit
save
```

#### Result in /etc/resolv.conf

```bash
# After applying the configuration:
# nameserver 8.8.8.8
# nameserver 8.8.4.4
# search vyos.io vyos.net vyos.network
```

#### Verification

```bash
# With domain-search set to: example.com

# Query a short name
vyos@router:~$ ping server1
# The system tries: server1.example.com

# Query with a trailing dot (FQDN) - no suffix is appended
vyos@router:~$ ping server1.other-domain.org.
# The system queries: server1.other-domain.org (unchanged)

# Query a full name (containing dots) - a suffix is appended
vyos@router:~$ ping server1.local
# The system tries: server1.local.example.com, then server1.local
```

### Removing domain-search

```bash
# Remove a specific domain
delete system domain-search vyos.network

# Remove all domains
delete system domain-search

commit
save
```

## DNS Configuration Priority

### Static vs DHCP Configuration

VyOS supports obtaining DNS servers via DHCP on WAN interfaces, but static configuration takes precedence.

**Behavior:**
1. If static `system name-server` entries are configured, only they are used
2. If no static servers are configured, DNS from DHCP is used
3. If DHCP does not provide DNS and there are no static entries, the system uses the built-in fallback (127.0.0.1 for the local DNS cache, if enabled)

#### Example 1: Static servers only

```bash
# Static configuration
set system name-server 8.8.8.8
set system name-server 8.8.4.4

# DHCP on the WAN interface (provides DNS, but it is ignored)
set interfaces ethernet eth0 address dhcp

commit
save

# Result: only 8.8.8.8 and 8.8.4.4 are used
```

#### Example 2: DHCP servers only

```bash
# No static name-server configuration

# DHCP on the WAN interface (provides DNS)
set interfaces ethernet eth0 address dhcp

commit
save

# Result: the DNS servers obtained via DHCP are used
```

#### Example 3: Hybrid configuration (does not work as expected)

```bash
# MISTAKE: Attempting to combine static and DHCP DNS
set system name-server 8.8.8.8
set interfaces ethernet eth0 address dhcp

# Result: only 8.8.8.8 is used, DHCP DNS is ignored
```

**Recommendation:**
- For production systems, use static DNS servers only
- Reserve DHCP DNS for temporary or test configurations
- Do not mix the two approaches - it leads to confusion

### Overriding DHCP DNS

If you need to use static DNS instead of DHCP:

```bash
# Disable obtaining DNS via DHCP on the interface
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 dhcp-options no-default-route
set interfaces ethernet eth0 dhcp-options reject nameserver

# Configure static DNS
set system name-server 8.8.8.8
set system name-server 8.8.4.4

commit
save
```

**Note:** The `reject nameserver` option may not be available in some VyOS versions. In that case, simply configure static servers - they will take precedence.

## Cloud Providers

### Yandex Cloud

Yandex Cloud provides internal DNS servers for resolving the internal names of virtual machines and services.

#### Using the Yandex Cloud Internal DNS

```bash
# Yandex Cloud internal DNS server (the second IP in the subnet)
# For the subnet 10.128.0.0/24 this is 10.128.0.2
set system name-server 10.128.0.2

commit
save
```

**How it works:**
- Each subnet in Yandex Cloud has a built-in DNS server at the second IP address
- For the subnet `10.128.0.0/24` the DNS is: `10.128.0.2`
- For the subnet `192.168.1.0/24` the DNS is: `192.168.1.2`
- It resolves internal FQDNs of virtual machines: `vm-name.auto.internal`

#### Using Yandex Public DNS

```bash
# Yandex public DNS servers (77.88.8.8)
set system name-server 77.88.8.8
set system name-server 77.88.8.1

commit
save
```

**Yandex DNS characteristics:**
- Addresses: `77.88.8.8`, `77.88.8.1`
- DNSSEC support
- Malicious site filtering (optional)
- Low latency for clients in Russia

#### Hybrid Yandex Cloud Configuration

```bash
# Internal DNS for local names + public DNS for the internet
set system name-server 10.128.0.2
set system name-server 77.88.8.8
set system name-server 77.88.8.1

# Domain-search for internal names
set system domain-search auto.internal
set system domain-search ru-central1.internal

commit
save
```

#### Complete Configuration Example for Yandex Cloud

```bash
configure

# Hostname
set system host-name vyos-gateway-ru-central1-a
set system domain-name ru-central1.internal

# DNS configuration
# First - Yandex Cloud internal DNS (resolves *.auto.internal)
set system name-server 10.128.0.2

# Second - Yandex public DNS (for external names)
set system name-server 77.88.8.8

# Third - backup public DNS
set system name-server 77.88.8.1

# Domain search for automatically appending suffixes
set system domain-search ru-central1.internal
set system domain-search auto.internal

# NTP servers (to verify DNS resolution)
set service ntp server ntp1.yandex.ru
set service ntp server ntp2.yandex.ru

commit
save
exit
```

**Verification:**

```bash
# Check internal resolution
vyos@vyos-gateway-ru-central1-a:~$ nslookup vm-name.auto.internal
# Should resolve via 10.128.0.2

# Check external resolution
vyos@vyos-gateway-ru-central1-a:~$ nslookup google.com
# Should resolve via 77.88.8.8

# Check the configuration
vyos@vyos-gateway-ru-central1-a:~$ cat /etc/resolv.conf
# nameserver 10.128.0.2
# nameserver 77.88.8.8
# nameserver 77.88.8.1
# search ru-central1.internal auto.internal
```

### VK Cloud (Cloud.ru)

VK Cloud provides internal DNS servers for resolving virtual machines within a project.

#### Using the VK Cloud Internal DNS

```bash
# VK Cloud internal DNS server (the second IP in the subnet)
# For the subnet 10.0.0.0/24 this is 10.0.0.2
set system name-server 10.0.0.2

commit
save
```

**How it works:**
- Similar to Yandex Cloud, each subnet has a DNS server at the second IP
- It resolves internal FQDNs of virtual machines
- FQDN format: `vm-name.mcs.local` or `vm-name.cloud.local`

#### Using VK Cloud Public DNS

VK Cloud does not provide public DNS servers. It is recommended to use:

```bash
# Google DNS
set system name-server 8.8.8.8
set system name-server 8.8.4.4

# Or Cloudflare DNS
set system name-server 1.1.1.1
set system name-server 1.0.0.1

# Or Yandex DNS
set system name-server 77.88.8.8
set system name-server 77.88.8.1

commit
save
```

#### Complete Configuration Example for VK Cloud

```bash
configure

# Hostname
set system host-name vyos-gateway-msk1
set system domain-name msk1.cloud.vk.com

# DNS configuration
# VK Cloud internal DNS (resolves local VMs)
set system name-server 10.0.0.2

# Public DNS for external names
set system name-server 8.8.8.8
set system name-server 8.8.4.4

# Domain search
set system domain-search msk1.cloud.vk.com
set system domain-search mcs.local

# NTP
set service ntp server 0.ru.pool.ntp.org
set service ntp server 1.ru.pool.ntp.org

commit
save
exit
```

### AWS (Amazon Web Services)

AWS provides an internal DNS resolver for every VPC.

#### Using the Amazon Route 53 Resolver

```bash
# Amazon Route 53 Resolver (VPC DNS)
# Always available at IP: <VPC_CIDR_BASE> + 2
# For the VPC 10.0.0.0/16 this is 10.0.0.2
set system name-server 10.0.0.2

commit
save
```

**How it works:**
- DNS address: `<VPC_CIDR_BASE> + 2`
- Resolves internal EC2 names: `ip-10-0-1-5.ec2.internal`
- Resolves Route 53 Private Hosted Zones
- Forwards public queries to the internet

#### Example for AWS

```bash
configure

# Hostname
set system host-name vyos-gateway-us-east-1a
set system domain-name us-east-1.compute.internal

# DNS configuration
set system name-server 10.0.0.2

# Domain search for EC2
set system domain-search us-east-1.compute.internal
set system domain-search ec2.internal

# NTP (AWS Time Sync Service)
set service ntp server 169.254.169.123

commit
save
exit
```

### Azure (Microsoft Azure)

Azure provides built-in DNS for every virtual network environment.

#### Using Azure DNS

```bash
# Azure Virtual Network DNS
# Address: 168.63.129.16 (special Azure metadata IP)
set system name-server 168.63.129.16

commit
save
```

**How it works:**
- Address: `168.63.129.16` (used for all VNets)
- Resolves internal Azure VM names
- Supports Azure Private DNS Zones
- Forwards public queries

#### Example for Azure

```bash
configure

# Hostname
set system host-name vyos-gateway-westeurope
set system domain-name internal.cloudapp.net

# DNS configuration
set system name-server 168.63.129.16

# Domain search
set system domain-search internal.cloudapp.net

# NTP (Azure NTP)
set service ntp server time.windows.com

commit
save
exit
```

### Google Cloud Platform (GCP)

GCP provides an internal DNS resolver for every VPC network.

#### Using Google Cloud DNS

```bash
# Google Cloud DNS (metadata server)
set system name-server 169.254.169.254

# Or use the internal VPC DNS
# For the subnet 10.128.0.0/20 this is 10.128.0.2
set system name-server 10.128.0.2

commit
save
```

**How it works:**
- Metadata DNS: `169.254.169.254`
- VPC DNS: `<SUBNET_CIDR_BASE> + 2`
- Resolves internal GCP VM names: `vm-name.c.project-id.internal`
- Supports Cloud DNS Private Zones

#### Example for GCP

```bash
configure

# Hostname
set system host-name vyos-gateway-europe-west1-b
set system domain-name c.my-project-id.internal

# DNS configuration
set system name-server 169.254.169.254
set system name-server 10.128.0.2

# Domain search
set system domain-search c.my-project-id.internal

# NTP (Google Public NTP)
set service ntp server time.google.com

commit
save
exit
```

## Configuration Examples

### Example 1: Corporate Network with Internal DNS

**Goal:** Configure VyOS to use corporate DNS with public backup servers.

```bash
configure

# DNS configuration
# Primary corporate DNS (Active Directory)
set system name-server 192.168.1.10

# Backup corporate DNS
set system name-server 192.168.1.11

# Public backup (in case the corporate servers fail)
set system name-server 8.8.8.8

# Domain search for corporate domains
set system domain-search corp.example.com
set system domain-search example.com

# Hostname
set system host-name vyos-gateway
set system domain-name corp.example.com

commit
save
exit
```

**Verification:**

```bash
# Check resolution of corporate names
nslookup dc01
# Should resolve as dc01.corp.example.com via 192.168.1.10

# Check resolution of external names
nslookup google.com
# Should resolve via the corporate DNS

# Check the configuration
cat /etc/resolv.conf
```

### Example 2: Edge Router with Public DNS

**Goal:** Configure an edge router with reliable public DNS.

```bash
configure

# DNS configuration with multiple providers
# Google DNS
set system name-server 8.8.8.8
set system name-server 8.8.4.4

# Cloudflare DNS
set system name-server 1.1.1.1

# Hostname
set system host-name vyos-edge-router
set system domain-name edge.local

commit
save
exit
```

### Example 3: Multi-site with Conditional Forwarding

**Goal:** A headquarters with branch offices, where each branch has its own DNS domain.

```bash
configure

# Main office (Moscow)
set system host-name vyos-hq-moscow
set system domain-name moscow.corp.local

# DNS servers
# Local DNS (resolves moscow.corp.local)
set system name-server 192.168.1.53

# Headquarters DNS (resolves corp.local and the branches)
set system name-server 10.0.0.53

# Public backup
set system name-server 8.8.8.8

# Domain search for all branches
set system domain-search moscow.corp.local
set system domain-search spb.corp.local
set system domain-search ekb.corp.local
set system domain-search corp.local

commit
save
exit
```

**Branch (Saint Petersburg):**

```bash
configure

set system host-name vyos-branch-spb
set system domain-name spb.corp.local

# Branch local DNS
set system name-server 192.168.2.53

# Headquarters DNS over VPN
set system name-server 10.0.0.53

# Public backup
set system name-server 8.8.8.8

# Domain search
set system domain-search spb.corp.local
set system domain-search corp.local

commit
save
exit
```

### Example 4: DMZ with Restricted DNS

**Goal:** A DMZ router that should resolve only specific domains.

```bash
configure

set system host-name vyos-dmz
set system domain-name dmz.example.com

# DNS server with a whitelist for the DMZ
set system name-server 10.10.10.53

# Public backup (restricted by firewall rules)
set system name-server 8.8.8.8

# Domain search for the DMZ only
set system domain-search dmz.example.com

commit
save
exit
```

### Example 5: IPv6-only Network

**Goal:** Configure DNS for an IPv6-only infrastructure.

```bash
configure

set system host-name vyos-ipv6-router
set system domain-name ipv6.example.com

# Google DNS (IPv6)
set system name-server 2001:4860:4860::8888
set system name-server 2001:4860:4860::8844

# Cloudflare DNS (IPv6)
set system name-server 2606:4700:4700::1111
set system name-server 2606:4700:4700::1001

# Domain search
set system domain-search ipv6.example.com

commit
save
exit
```

### Example 6: Dual-stack with IPv6 Priority

**Goal:** A dual-stack network that prefers IPv6 for DNS.

```bash
configure

set system host-name vyos-dualstack
set system domain-name dualstack.example.com

# IPv6 DNS servers (priority - listed first)
set system name-server 2001:4860:4860::8888
set system name-server 2001:4860:4860::8844

# IPv4 DNS servers (fallback)
set system name-server 8.8.8.8
set system name-server 8.8.4.4

# Domain search
set system domain-search dualstack.example.com

commit
save
exit
```

## Verification and Monitoring Commands

### Checking the DNS Configuration

```bash
# Show the configured DNS servers
show configuration system name-server

# Show domain-search
show configuration system domain-search

# Show the entire system configuration
show configuration system
```

### Checking /etc/resolv.conf

```bash
# View the current contents of resolv.conf
cat /etc/resolv.conf

# Example output:
# nameserver 8.8.8.8
# nameserver 8.8.4.4
# search vyos.io vyos.net
```

### Testing DNS Resolution

#### Basic Commands

```bash
# DNS lookup with nslookup
nslookup google.com

# Output:
# Server:         8.8.8.8
# Address:        8.8.8.8#53
#
# Non-authoritative answer:
# Name:   google.com
# Address: 142.250.185.46
```

```bash
# DNS lookup with dig
dig google.com

# Concise information
dig google.com +short

# Query a specific DNS server
dig @8.8.8.8 google.com
```

```bash
# DNS lookup with host
host google.com

# Reverse DNS lookup
host 8.8.8.8
```

#### Checking domain-search

```bash
# With domain-search set to: example.com

# Query a short name (a suffix should be appended)
dig server1

# The output will show: server1.example.com

# Check with verbose search
dig +search server1
```

#### Tracing DNS Queries

```bash
# Full trace of DNS resolution
dig +trace google.com

# Output:
# . 86400 IN NS a.root-servers.net.
# ...
# google.com. 172800 IN NS ns1.google.com.
# ...
# google.com. 300 IN A 142.250.185.46
```

#### Checking DNSSEC

```bash
# Check DNSSEC signatures
dig google.com +dnssec

# Check DNSSEC validity
dig google.com +dnssec +multiline
```

### Monitoring DNS Performance

```bash
# Measure resolution time
time nslookup google.com

# Output:
# real    0m0.045s
# user    0m0.012s
# sys     0m0.008s
```

```bash
# DNS query statistics with dig
dig google.com +stats

# The output includes:
# ;; Query time: 45 msec
# ;; SERVER: 8.8.8.8#53(8.8.8.8)
# ;; WHEN: Wed Jan 15 10:30:45 MSK 2025
# ;; MSG SIZE  rcvd: 55
```

### Checking DNS Server Availability

```bash
# Ping the DNS server
ping -c 4 8.8.8.8

# Check UDP port 53
nc -vuz 8.8.8.8 53

# Or with nmap
nmap -sU -p 53 8.8.8.8
```

### Checking DNS for a Specific Domain

```bash
# Query all DNS records
dig example.com ANY

# Query specific record types
dig example.com A      # IPv4 address
dig example.com AAAA   # IPv6 address
dig example.com MX     # Mail exchange
dig example.com NS     # Name servers
dig example.com TXT    # Text records
dig example.com SOA    # Start of authority
```

### Checking Reverse DNS

```bash
# Reverse lookup (PTR record)
dig -x 8.8.8.8

# Or with host
host 8.8.8.8

# Or with nslookup
nslookup 8.8.8.8
```

### Logging DNS Queries

```bash
# Enable DNS debug logging (temporarily)
sudo tcpdump -i any port 53 -vv

# Log DNS queries to a file
sudo tcpdump -i any port 53 -w /tmp/dns-traffic.pcap

# Analyze the saved file
sudo tcpdump -r /tmp/dns-traffic.pcap -vv
```

### Checking the DNS Cache

```bash
# VyOS has no built-in system-level DNS cache
# But if dns forwarding is enabled, you can check its cache

# Show dns forwarding statistics (if configured)
show dns forwarding statistics

# Clear the dns forwarding cache (if configured)
reset dns forwarding cache
```

## Troubleshooting

### Problem 1: DNS Does Not Resolve Names

**Symptoms:**
- The `nslookup`, `dig`, and `host` commands return errors
- The system cannot update packages via `apt update`
- NTP does not synchronize (when NTP servers are specified by name)

**Diagnostics:**

```bash
# Check the DNS configuration
show configuration system name-server

# Check /etc/resolv.conf
cat /etc/resolv.conf

# Check DNS server availability
ping 8.8.8.8

# Check UDP port 53
nc -vuz 8.8.8.8 53

# Check DNS resolution
nslookup google.com
```

**Solution:**

```bash
# If no DNS servers are configured - configure them
configure
set system name-server 8.8.8.8
set system name-server 8.8.4.4
commit
save
exit

# Check firewall rules (DNS must be allowed)
show firewall

# Add a rule if DNS is being blocked
configure
set firewall name WAN_LOCAL rule 100 action accept
set firewall name WAN_LOCAL rule 100 protocol udp
set firewall name WAN_LOCAL rule 100 destination port 53
commit
save
exit

# Check the result
nslookup google.com
```

### Problem 2: Slow DNS Resolution

**Symptoms:**
- DNS commands take several seconds
- Web browsing is slow
- SSH connections take a long time to establish

**Diagnostics:**

```bash
# Measure resolution time
time nslookup google.com

# Check the RTT to the DNS servers
ping -c 10 8.8.8.8

# Check dig statistics
dig google.com +stats

# Trace the route to the DNS server
traceroute 8.8.8.8
```

**Solution:**

```bash
# Use faster or closer DNS servers
configure

# Remove the slow servers
delete system name-server 8.8.8.8

# Add fast local servers
set system name-server 192.168.1.53  # Local DNS
set system name-server 77.88.8.8     # Yandex DNS (for Russia)

commit
save
exit

# Check the improvement
time nslookup google.com
```

### Problem 3: Domain-search Does Not Work

**Symptoms:**
- Short names do not resolve
- You have to specify full FQDNs

**Diagnostics:**

```bash
# Check the domain-search configuration
show configuration system domain-search

# Check /etc/resolv.conf
cat /etc/resolv.conf | grep search

# Test query
dig +search server1
```

**Solution:**

```bash
# Configure domain-search
configure
set system domain-search example.com
commit
save
exit

# Check /etc/resolv.conf
cat /etc/resolv.conf
# There should be a line: search example.com

# Test query
dig server1
# Should resolve as server1.example.com
```

### Problem 4: DNS Resolves Only IPv6 or Only IPv4

**Symptoms:**
- Dual-stack names resolve to only one address type
- No A or AAAA records

**Diagnostics:**

```bash
# Check IPv4 resolution
dig google.com A

# Check IPv6 resolution
dig google.com AAAA

# Check both
dig google.com A AAAA
```

**Solution:**

```bash
# Make sure you are using DNS servers that support both protocols
configure

# For dual-stack, use modern DNS
set system name-server 8.8.8.8
set system name-server 2001:4860:4860::8888

commit
save
exit

# Check both record types
dig google.com A
dig google.com AAAA
```

### Problem 5: Conflict Between Static and DHCP DNS

**Symptoms:**
- DNS servers change after a reboot
- /etc/resolv.conf contains unexpected servers

**Diagnostics:**

```bash
# Check the static configuration
show configuration system name-server

# Check the DHCP configuration on the interfaces
show configuration interfaces ethernet

# Check /etc/resolv.conf
cat /etc/resolv.conf
```

**Solution:**

```bash
# Option 1: Use static DNS only
configure
set system name-server 8.8.8.8
set system name-server 8.8.4.4
commit
save
exit

# Option 2: Use DHCP DNS only
configure
delete system name-server
commit
save
exit

# Option 3: Disable DHCP DNS on the interface (if supported)
configure
set interfaces ethernet eth0 dhcp-options no-default-route
commit
save
exit
```

### Problem 6: DNS Does Not Resolve Internal Cloud Names

**Symptoms:**
- External names resolve, but internal ones (*.auto.internal, *.ec2.internal) do not
- Public DNS is used instead of the cloud DNS

**Diagnostics:**

```bash
# Check the DNS configuration
show configuration system name-server

# Try to resolve an internal name
nslookup vm-name.auto.internal

# Check which DNS server is being used
dig vm-name.auto.internal
```

**Solution (Yandex Cloud):**

```bash
configure

# Add the Yandex Cloud internal DNS first
set system name-server 10.128.0.2

# Then the public ones
set system name-server 77.88.8.8

# Domain-search for internal names
set system domain-search auto.internal
set system domain-search ru-central1.internal

commit
save
exit

# Check
nslookup vm-name.auto.internal
```

**Solution (AWS):**

```bash
configure

# Use the VPC DNS
set system name-server 10.0.0.2

# Domain-search for EC2
set system domain-search us-east-1.compute.internal
set system domain-search ec2.internal

commit
save
exit

# Check
nslookup ip-10-0-1-5.ec2.internal
```

### Problem 7: VRF Routing for DNS Does Not Work

**Symptoms:**
- A management VRF is configured, but DNS traffic goes through the default VRF
- DNS is unreachable in the isolated VRF

**Explanation:**

Current VyOS versions have no way to route system DNS traffic through a specific VRF. This is a known limitation.

**Workaround:**

```bash
# Option 1: Use a DNS server reachable from the default VRF
configure
set system name-server 8.8.8.8  # Public DNS via the default route
commit
save
exit

# Option 2: Configure a static route for the DNS server
configure
set protocols static route 192.168.1.53/32 next-hop 10.0.0.1
commit
save
exit

# Option 3: Use DNS forwarding with source-address
# (allows specifying the source IP for queries)
configure
set service dns forwarding listen-address 127.0.0.1
set service dns forwarding name-server 192.168.1.53
set service dns forwarding source-address 10.0.0.10
commit
save
exit

# Change system name-server to localhost
configure
set system name-server 127.0.0.1
commit
save
exit
```

### Problem 8: DNSSEC Validation Does Not Work

**Symptoms:**
- DNSSEC-signed domains do not resolve
- DNSSEC validation errors

**Diagnostics:**

```bash
# Check DNSSEC validation
dig google.com +dnssec

# Check whether the DNS server supports DNSSEC
dig @8.8.8.8 . DNSKEY
```

**Solution:**

```bash
# Use DNS servers with DNSSEC support
configure

# Google DNS (supports DNSSEC)
set system name-server 8.8.8.8

# Cloudflare DNS (supports DNSSEC)
set system name-server 1.1.1.1

# Yandex DNS (supports DNSSEC)
set system name-server 77.88.8.8

commit
save
exit

# Check DNSSEC
dig google.com +dnssec
```

## Best Practices

### 1. Choosing DNS Servers

**Use at least 2 DNS servers:**

```bash
# Good: 2-3 servers
set system name-server 8.8.8.8
set system name-server 8.8.4.4

# Bad: only one server
set system name-server 8.8.8.8
```

**Choose servers with a low RTT:**

```bash
# Check the RTT
ping -c 10 8.8.8.8
ping -c 10 77.88.8.8
ping -c 10 1.1.1.1

# Use the server with the lowest RTT
# For Russia, typically:
set system name-server 77.88.8.8  # Yandex, ~5-10ms
set system name-server 8.8.8.8    # Google, ~20-30ms
```

**Combine different providers:**

```bash
# Diversify DNS providers
set system name-server 77.88.8.8   # Yandex
set system name-server 8.8.8.8     # Google
set system name-server 1.1.1.1     # Cloudflare
```

### 2. Cloud Infrastructures

**Always list the internal cloud DNS first:**

```bash
# Yandex Cloud
set system name-server 10.128.0.2   # Internal DNS
set system name-server 77.88.8.8    # Public backup

# AWS
set system name-server 10.0.0.2     # VPC DNS
set system name-server 8.8.8.8      # Public backup

# Azure
set system name-server 168.63.129.16  # Azure DNS
set system name-server 8.8.8.8        # Public backup
```

**Configure domain-search for internal names:**

```bash
# Yandex Cloud
set system domain-search auto.internal
set system domain-search ru-central1.internal

# AWS
set system domain-search us-east-1.compute.internal
set system domain-search ec2.internal
```

### 3. Corporate Networks

**Prioritize internal DNS:**

```bash
# Corporate DNS first (resolves internal.corp.com)
set system name-server 192.168.1.10

# Corporate backup
set system name-server 192.168.1.11

# Public DNS only as a last resort
set system name-server 8.8.8.8
```

**Use domain-search for convenience:**

```bash
set system domain-search corp.example.com
set system domain-search example.com

# Lets you use:
# ping dc01 -> dc01.corp.example.com
# ping exchange -> exchange.corp.example.com
```

### 4. Security

**Use only trusted DNS servers:**

```bash
# Good: well-known public DNS
set system name-server 8.8.8.8     # Google
set system name-server 1.1.1.1     # Cloudflare
set system name-server 77.88.8.8   # Yandex

# Bad: random unknown DNS
set system name-server 123.45.67.89
```

**Consider DNS over TLS/HTTPS for privacy:**

Note: VyOS does not support DoT/DoH directly via system name-server, but you can configure it through dns forwarding or an external DNS proxy.

```bash
# Option with dns forwarding (requires additional steps)
set service dns forwarding listen-address 127.0.0.1
set service dns forwarding name-server 1.1.1.1
# Additional DoH setup requires manual configuration

set system name-server 127.0.0.1
```

**Monitor DNS traffic:**

```bash
# Periodically check DNS queries
sudo tcpdump -i any port 53 -c 100

# Look for suspicious queries
```

### 5. Performance

**Minimize latency:**

```bash
# Check the RTT to various DNS servers
ping -c 10 8.8.8.8
ping -c 10 77.88.8.8
ping -c 10 1.1.1.1

# Use the fastest ones
```

**Limit the number of domain-search entries:**

```bash
# Good: 1-3 domains
set system domain-search corp.local
set system domain-search local

# Bad: too many domains (slows down resolution)
set system domain-search domain1.com
set system domain-search domain2.com
set system domain-search domain3.com
set system domain-search domain4.com
set system domain-search domain5.com
set system domain-search domain6.com
```

**Use a local DNS cache:**

```bash
# Configure dns forwarding as a local cache
set service dns forwarding listen-address 127.0.0.1
set service dns forwarding cache-size 10000
set service dns forwarding name-server 8.8.8.8
set service dns forwarding name-server 8.8.4.4

# Change system name-server to localhost
set system name-server 127.0.0.1

commit
save
```

### 6. Redundancy

**DNS server redundancy:**

```bash
# Minimum of 2, 3 recommended
set system name-server 192.168.1.10
set system name-server 192.168.1.11
set system name-server 8.8.8.8
```

**Geographic redundancy:**

```bash
# DNS servers in different data centers
set system name-server 10.0.1.53   # DC1
set system name-server 10.1.1.53   # DC2
set system name-server 8.8.8.8     # Public backup
```

### 7. Monitoring and Alerting

**Check DNS regularly:**

```bash
# DNS monitoring script
sudo tee /config/scripts/dns-monitor.sh > /dev/null <<'EOF'
#!/bin/bash
# DNS resolution monitoring

DNS_SERVERS="8.8.8.8 8.8.4.4"
TEST_DOMAIN="google.com"
TIMEOUT=5

for server in $DNS_SERVERS; do
    response=$(dig @$server $TEST_DOMAIN +time=$TIMEOUT +tries=1 +short 2>&1)
    if [ $? -eq 0 ] && [ -n "$response" ]; then
        echo "DNS $server: OK"
        logger -t dns-monitor "DNS $server: OK"
    else
        echo "DNS $server: FAILED"
        logger -t dns-monitor "ERROR: DNS $server FAILED"
        # Send an alert
    fi
done
EOF

chmod +x /config/scripts/dns-monitor.sh

# Schedule a check every 5 minutes
set system task-scheduler task dns-monitor interval '*/5 * * * *'
set system task-scheduler task dns-monitor executable path '/config/scripts/dns-monitor.sh'

commit
save
```

**Alerting on DNS loss:**

```bash
# Integration with a monitoring system
# For example, sending to syslog for SIEM analysis
set system syslog host 10.0.0.100 facility local7 level warning
```

### 8. Documentation

**Document your DNS server choices:**

```bash
# Add comments to the configuration
configure
set system name-server 192.168.1.10
set system name-server 192.168.1.11
set system name-server 8.8.8.8

commit comment "DNS: 192.168.1.10/11 - corporate AD DNS, 8.8.8.8 - backup"
save
```

**Keep a change history:**

```bash
# View the DNS change history
show system commit

# Compare configurations
show system commit diff 10
```

### 9. IPv6 Ready

**Support dual-stack:**

```bash
# IPv4 + IPv6 DNS servers
set system name-server 8.8.8.8
set system name-server 8.8.4.4
set system name-server 2001:4860:4860::8888
set system name-server 2001:4860:4860::8844

commit
save
```

### 10. Testing and Validation

**Test DNS after changes:**

```bash
# Always test after changing the DNS configuration
nslookup google.com
nslookup internal-server.corp.local
ping -c 4 ntp.pool.org

# Check the resolution time
time nslookup google.com

# Check domain-search
dig +search server1
```

## Integration with Other VyOS Services

### NTP

DNS is used to resolve NTP servers specified by name:

```bash
configure

# DNS for resolving NTP servers
set system name-server 8.8.8.8
set system name-server 8.8.4.4

# NTP servers by name (require DNS resolution)
set service ntp server 0.pool.ntp.org
set service ntp server 1.pool.ntp.org

commit
save
exit

# Verify that the NTP servers resolve
nslookup 0.pool.ntp.org
show ntp
```

### Syslog

DNS is used to resolve remote syslog servers:

```bash
configure

# DNS configuration
set system name-server 8.8.8.8

# Syslog server by name
set system syslog host syslog.corp.local facility all level info
set system syslog host syslog.corp.local protocol tcp
set system syslog host syslog.corp.local port 514

commit
save
exit

# Verify resolution of the syslog server
nslookup syslog.corp.local
```

### DNS Forwarding

System name-server can be used together with dns forwarding:

```bash
configure

# System DNS (for the VyOS system itself)
set system name-server 8.8.8.8
set system name-server 8.8.4.4

# DNS Forwarding (for LAN clients)
set service dns forwarding listen-address 192.168.1.1
set service dns forwarding name-server 8.8.8.8
set service dns forwarding name-server 8.8.4.4

commit
save
exit
```

The difference:
- `system name-server` - used by the VyOS system itself
- `service dns forwarding name-server` - upstream servers for clients

### VPN

DNS is used to resolve remote VPN endpoints:

```bash
configure

# DNS configuration
set system name-server 8.8.8.8

# IPsec VPN with a peer by name
set vpn ipsec site-to-site peer vpn-gateway.example.com
set vpn ipsec site-to-site peer vpn-gateway.example.com authentication mode pre-shared-secret
set vpn ipsec site-to-site peer vpn-gateway.example.com authentication pre-shared-secret secret123

commit
save
exit

# Verify resolution of the VPN peer
nslookup vpn-gateway.example.com
```

### Containers

DNS is used to pull container images:

```bash
configure

# DNS configuration
set system name-server 8.8.8.8

# Container with an image from a registry by name
set container name nginx image docker.io/nginx:latest

commit
save
exit

# Verify resolution of the registry
nslookup docker.io
```

## Automation Scripts

### DNS Health Check Script

```bash
sudo tee /config/scripts/dns-health-check.sh > /dev/null <<'EOF'
#!/bin/bash
# DNS Health Check Script

# Parameters
TEST_DOMAINS="google.com cloudflare.com yandex.ru"
DNS_SERVERS=$(grep ^nameserver /etc/resolv.conf | awk '{print $2}')
TIMEOUT=5

echo "=== DNS Health Check ==="
echo "Date: $(date)"
echo ""

# Check each DNS server
for dns in $DNS_SERVERS; do
    echo "Testing DNS server: $dns"

    # Check DNS server availability
    if ping -c 1 -W 1 $dns > /dev/null 2>&1; then
        echo "  [OK] DNS server is reachable"
    else
        echo "  [FAIL] DNS server is unreachable"
        continue
    fi

    # Check resolution of the test domains
    for domain in $TEST_DOMAINS; do
        start=$(date +%s%N)
        result=$(dig @$dns $domain +time=$TIMEOUT +tries=1 +short 2>&1)
        end=$(date +%s%N)

        if [ $? -eq 0 ] && [ -n "$result" ]; then
            duration=$(( ($end - $start) / 1000000 ))
            echo "  [OK] $domain resolved in ${duration}ms"
        else
            echo "  [FAIL] $domain resolution failed"
        fi
    done

    echo ""
done

echo "=== DNS Health Check Complete ==="
EOF

chmod +x /config/scripts/dns-health-check.sh

# Run the check
/config/scripts/dns-health-check.sh
```

### Script for Automatically Selecting the Best DNS

```bash
sudo tee /config/scripts/dns-benchmark.sh > /dev/null <<'EOF'
#!/bin/bash
# DNS Benchmark Script

DNS_CANDIDATES="8.8.8.8 8.8.4.4 1.1.1.1 1.0.0.1 77.88.8.8 77.88.8.1"
TEST_DOMAIN="google.com"
TEST_COUNT=10

echo "=== DNS Benchmark ==="

declare -A dns_times

for dns in $DNS_CANDIDATES; do
    echo -n "Testing $dns ... "

    total=0
    success=0

    for i in $(seq 1 $TEST_COUNT); do
        start=$(date +%s%N)
        dig @$dns $TEST_DOMAIN +time=2 +tries=1 +short > /dev/null 2>&1
        if [ $? -eq 0 ]; then
            end=$(date +%s%N)
            duration=$(( ($end - $start) / 1000000 ))
            total=$(( $total + $duration ))
            success=$(( $success + 1 ))
        fi
    done

    if [ $success -gt 0 ]; then
        avg=$(( $total / $success ))
        dns_times[$dns]=$avg
        echo "Average: ${avg}ms (${success}/${TEST_COUNT} success)"
    else
        echo "FAILED"
    fi
done

echo ""
echo "=== Recommended DNS Servers ==="

# Sort by time
for dns in "${!dns_times[@]}"; do
    echo "${dns_times[$dns]} $dns"
done | sort -n | head -3 | while read time dns; do
    echo "set system name-server $dns  # ${time}ms"
done
EOF

chmod +x /config/scripts/dns-benchmark.sh

# Run the benchmark
/config/scripts/dns-benchmark.sh
```

### DNS Configuration Export Script

```bash
sudo tee /config/scripts/export-dns-config.sh > /dev/null <<'EOF'
#!/bin/vbash
# Export DNS Configuration to JSON

source /opt/vyatta/etc/functions/script-template

OUTPUT_FILE="/config/dns-config-export.json"

echo "{" > "$OUTPUT_FILE"
echo "  \"timestamp\": \"$(date -Iseconds)\"," >> "$OUTPUT_FILE"
echo "  \"hostname\": \"$(hostname)\"," >> "$OUTPUT_FILE"
echo "  \"name_servers\": [" >> "$OUTPUT_FILE"

# Get the DNS servers
NAMESERVERS=$(grep ^nameserver /etc/resolv.conf | awk '{print $2}')
FIRST=1
for ns in $NAMESERVERS; do
    if [ $FIRST -eq 1 ]; then
        FIRST=0
    else
        echo "," >> "$OUTPUT_FILE"
    fi
    echo -n "    \"$ns\"" >> "$OUTPUT_FILE"
done

echo "" >> "$OUTPUT_FILE"
echo "  ]," >> "$OUTPUT_FILE"
echo "  \"domain_search\": [" >> "$OUTPUT_FILE"

# Get domain-search
SEARCH=$(grep ^search /etc/resolv.conf | sed 's/search //')
FIRST=1
for domain in $SEARCH; do
    if [ $FIRST -eq 1 ]; then
        FIRST=0
    else
        echo "," >> "$OUTPUT_FILE"
    fi
    echo -n "    \"$domain\"" >> "$OUTPUT_FILE"
done

echo "" >> "$OUTPUT_FILE"
echo "  ]" >> "$OUTPUT_FILE"
echo "}" >> "$OUTPUT_FILE"

echo "DNS configuration exported to $OUTPUT_FILE"
cat "$OUTPUT_FILE"
EOF

chmod +x /config/scripts/export-dns-config.sh

# Run the export
/config/scripts/export-dns-config.sh
```

## Related Documents

- [System Configuration](/docs/vyos/system/) - General system configuration
- [Host Name](/docs/vyos/system/vyos-host-name/) - Configuring the hostname and static entries
- [DNS Forwarding](/docs/vyos/services/vyos-dns/) - DNS server for clients
- [NTP](/docs/vyos/services/vyos-ntp/) - Time and NTP configuration
- [Syslog](/docs/vyos/system/vyos-syslog/) - System logging configuration
- [VPN](/docs/vyos/vpn/) - VPN configuration
- [Containers](/docs/vyos/containers/) - Container management

## Additional Resources

- [RFC 1034 - Domain Names - Concepts and Facilities](https://tools.ietf.org/html/rfc1034)
- [RFC 1035 - Domain Names - Implementation and Specification](https://tools.ietf.org/html/rfc1035)
- [RFC 1123 - Requirements for Internet Hosts](https://tools.ietf.org/html/rfc1123)
- [VyOS Documentation - Name Server](https://docs.vyos.io/en/latest/configuration/system/name-server.html)
- [Yandex Cloud DNS](https://cloud.yandex.ru/docs/vpc/concepts/dhcp-options)
- [AWS VPC DNS](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html)
- [Azure DNS](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances)
- [Google Cloud DNS](https://cloud.google.com/vpc/docs/dns)
- [Public DNS Comparison](https://www.dnsperf.com/)

## Conclusion

Correctly configuring the system DNS servers (name-server) and the domain search list (domain-search) in VyOS is critical for the proper operation of all system components. DNS is used for package updates, time synchronization via NTP, sending logs to remote servers, establishing VPN connections, and many other operations.

Key points:

1. **Redundancy**: Always configure at least 2-3 DNS servers for fault tolerance
2. **Performance**: Choose DNS servers with a low RTT for your region
3. **Cloud integration**: Use internal cloud DNS servers to resolve internal names
4. **Security**: Use only trusted DNS servers
5. **Monitoring**: Regularly verify that DNS is working
6. **Documentation**: Document your DNS server choices and configuration changes

Follow the recommendations in the "Best Practices" section to ensure a reliable and performant DNS infrastructure in your VyOS network.