Your server resolves names like api.example.com through DNS resolvers — usually your provider’s, set automatically. You might want different ones: a faster public resolver, a filtering service, your own Unbound or Pi-hole, or an internal DNS server. Where to change them depends on what manages networking on your system.

Step 1: find out who manages /etc/resolv.conf

ls -l /etc/resolv.conf
cat /etc/resolv.conf
  • A symlink to ../run/systemd/resolve/stub-resolv.conf with nameserver 127.0.0.53 → systemd-resolved (default on Ubuntu, and on some Debian setups).
  • Managed by NetworkManager (common on RHEL-family systems, desktops) → the file says “Generated by NetworkManager”.
  • A plain file → you can edit it directly (classic Debian with ifupdown).

Editing a managed /etc/resolv.conf directly appears to work — until the next reboot or network event overwrites it.

Ubuntu with Netplan (most common on VPS)

Set nameservers per interface in your Netplan file (e.g. /etc/netplan/01-netcfg.yaml):

network:
  version: 2
  ethernets:
    eth0:
      # … addresses/routes or dhcp4: true …
      nameservers:
        addresses: [1.1.1.1, 9.9.9.9]
        search: [example.lan]

With DHCP, the DHCP-provided resolvers are used too. To use only yours:

      dhcp4: true
      dhcp4-overrides:
        use-dns: false
      nameservers:
        addresses: [1.1.1.1, 9.9.9.9]

Apply safely:

sudo netplan try

See Netplan static IP for the full file format.

systemd-resolved directly

For a global setting independent of interfaces, edit /etc/systemd/resolved.conf (or create a drop-in in /etc/systemd/resolved.conf.d/dns.conf):

[Resolve]
DNS=1.1.1.1 9.9.9.9
FallbackDNS=8.8.8.8
DNSOverTLS=opportunistic
sudo systemctl restart systemd-resolved
resolvectl status

resolvectl status shows the resolvers in use globally and per link. Per-link servers (from DHCP or Netplan) take precedence for that interface; set Domains=~. in [Resolve] to route all queries to the global servers.

DNSOverTLS=yes forces encrypted DNS (requires resolvers that support it, such as 1.1.1.1 or 9.9.9.9); opportunistic uses it when available. See DNS over HTTPS and TLS.

NetworkManager (AlmaLinux, Rocky, Fedora)

nmcli connection show
sudo nmcli connection modify "System eth0" ipv4.dns "1.1.1.1 9.9.9.9" ipv4.ignore-auto-dns yes
sudo nmcli connection up "System eth0"
cat /etc/resolv.conf

Use your actual connection name from the first command. See nmcli.

Debian with ifupdown

If /etc/resolv.conf is a regular file, edit it:

nameserver 1.1.1.1
nameserver 9.9.9.9
options timeout:2 attempts:2

If the resolvconf package is installed, add dns-nameservers 1.1.1.1 9.9.9.9 to the interface in /etc/network/interfaces instead.

If DHCP keeps overwriting it, configure /etc/dhcp/dhclient.conf:

supersede domain-name-servers 1.1.1.1, 9.9.9.9;

Verify which resolver answers

resolvectl query example.com          # systemd-resolved
dig example.com                       # look at the SERVER: line
dig @9.9.9.9 example.com              # query a specific resolver directly
getent hosts example.com              # what applications actually get (uses nsswitch)

With systemd-resolved, dig shows 127.0.0.53 as the server — that’s the local stub, which forwards to the real resolvers listed by resolvectl status.

Flush caches after changes:

sudo resolvectl flush-caches

/etc/hosts still wins

Entries in /etc/hosts are checked before DNS (per /etc/nsswitch.conf). Useful for testing a site on a new server before changing public DNS:

203.0.113.10  example.com www.example.com

Remember to remove such entries afterwards.

Choosing resolvers

Resolver Addresses Notes
Cloudflare 1.1.1.1, 1.0.0.1 Fast, privacy-focused
Quad9 9.9.9.9, 149.112.112.112 Blocks known-malicious domains
Google 8.8.8.8, 8.8.4.4 Widely used
Your provider from DHCP Often closest; check reliability
Your own 127.0.0.1 (Unbound) Full control, caching, validation

For mail servers specifically, use a local recursive resolver: public resolvers are often rate-limited by DNS blocklists (RBLs). See Unbound.

Troubleshooting

  • Changes revert — something manages the file (resolved, NetworkManager, DHCP, cloud-init). Change it at the source.
  • Temporary failure in name resolution — no reachable resolver; check resolvectl status, firewall rules for outbound UDP/TCP 53, and that resolved is running.
  • Slow lookups — an unreachable first resolver; reorder or remove it, and check IPv6 resolvers on IPv4-only networks.

Related: dig command and DNS records explained.

  • DNS
  • Linux
  • Networking