SYSTEMD.DNS-DELEGATE(5)

💖 systemd.dns-delegate — DNS Server Delegation Configuration 💖

okay bestie, this is the systemd.dns-delegate page from the systemd.dns-delegate manual, and it's literally about telling your DNS lookups where to go. no cap. let's get into it 🦋

---

✨ SYNOPSIS ✨

/etc/systemd/dns-delegate.d/*.dns-delegate
/run/systemd/dns-delegate.d/*.dns-delegate
/usr/local/lib/systemd/dns-delegate.d/*.dns-delegate
/usr/lib/systemd/dns-delegate.d/*.dns-delegate

---

🌸 DESCRIPTION 🌸

so the way this works: *.dns-delegate files are how you delegate DNS lookups in specific domains to specific DNS servers. these files get read by systemd-resolved.service(8), which is the main character doing all the resolving around here 💅

every single one of these files defines a combination of one or more DNS servers and one or more DNS domains. and each definition synthesizes a DNS lookup scope — which means lookups below the domains you specified get sent to the DNS servers you specified. and lowkey, this can happen in addition to any per-interface scopes and the global scope that systemd-resolved maintains anyway. so it's not replacing anything, it's stacking. iconic behavior tbh.

---

🎀 [DELEGATE] SECTION OPTIONS 🎀

• DNS= — takes one or more DNS server specifications, using the exact same syntax as the option of the same name in resolved.conf(5). copy-paste energy, we love to see it ✨

Added in version 258.

• Domains= — takes one or more domain name specifications, again in the same syntax as the option of the same name in resolved.conf(5). fr fr, go read that one if you need the syntax deets 🫶

Added in version 258.

• DefaultRoute= — takes a boolean value, and it defaults to off. this controls whether this DNS server is a candidate for looking up records for which no better route exists. so like… the fallback bae 💜

Added in version 258.

• FirewallMark= — takes a 32 bit unsigned integer value. this controls the firewall mark of packets generated by the socket used to make DNS requests for this DNS delegate. you can use it in your firewall logic to filter packets coming from this socket. technically it sets the SO_MARK socket option — see iptables(8) for the details 🔥

Added in version 260.

---

🌈 EXAMPLES 🌈

Example 1.

# /etc/systemd/dns-delegate.d/foobar.dns-delegate
[Delegate]
DNS=203.0.113.47
Domains=foobar.com
FirewallMark=42

this ensures that lookups of "foobar.com" and any domains below it are directed to DNS server 203.0.113.47, and that any packets related to this lookup have a firewall mark set to 42. periodt. 💅✨

---

👑 SEE ALSO 👑

• systemd(1)
• systemd-resolved.service(8)
• resolved.conf(5)
• resolvectl(1)

---

okay that's the whole page bestie, you ate it 💖 this was the systemd.dns-delegate manual, served up by systemd 262.1 — go forth and delegate those lookups, you've got this 🦋🎀🌸