{"slug":"configuring-linux-dns","title":"Configuring Linux DNS","tags":["tailscale","dns"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Configuring Linux DNS\r\n\r\nLast validated: Jan 5, 2026\r\n\r\nThere are [an incredible number of ways](https://tailscale.com/blog/sisyphean-dns-client-linux) to configure DNS on Linux.\r\n\r\nTailscale attempts to interoperate with any Linux DNS configuration it\r\nfinds already present. Unfortunately, some are not entirely amenable\r\nto cooperatively managing the host's DNS configuration.\r\n\r\n## [Common problems](https://tailscale.com/docs/reference/linux-dns\\#common-problems)\r\n\r\n### [NetworkManager + systemd-resolved](https://tailscale.com/docs/reference/linux-dns\\#networkmanager--systemd-resolved)\r\n\r\nIf you're using both NetworkManager and systemd-resolved (as in\r\ncommon in many distros), you'll want to make sure that\r\n`/etc/resolv.conf` is a symlink to\r\n`/run/systemd/resolve/stub-resolv.conf`. That should be the\r\ndefault. If not,\r\n\r\n```shell\r\nsudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf\r\n```\r\n\r\nWhen NetworkManager sees that symlink is present, its default behavior\r\nis to use systemd-resolved and not take over the resolv.conf file.\r\n\r\nAfter fixing, restart everything:\r\n\r\n```shell\r\nsudo systemctl restart systemd-resolved\r\nsudo systemctl restart NetworkManager\r\nsudo systemctl restart tailscaled\r\n```\r\n\r\n### [DHCP `dhclient` overwriting `/etc/resolv.conf`](https://tailscale.com/docs/reference/linux-dns\\#dhcp-dhclient-overwriting-etcresolvconf)\r\n\r\nWithout any DNS management system installed, DHCP clients like\r\n`dhclient` and programs like `tailscaled` have no other options than\r\nrewriting the `/etc/resolv.conf` file themselves, which results in\r\nthem sometimes fighting with each other. (For instance, a DHCP renewal\r\nrewriting the `resolv.conf` resulting in loss of MagicDNS functionality.)\r\n\r\nPossible workarounds are to use `resolvconf` or `systemd-resolved`.\r\n[Issue 2334](https://github.com/tailscale/tailscale/issues/2334) tracks making Tailscale react to other\r\nprograms updating `resolv.conf` so Tailscale can add itself back.\r\n\r\n### [DNS issues with Amazon Linux](https://tailscale.com/docs/reference/linux-dns\\#dns-issues-with-amazon-linux)\r\n\r\nOn Amazon Linux, Tailscale's DNS can break due to an infinite forwarding loop. When Tailscale backs up and replaces `/etc/resolv.conf` with its own DNS server (`100.100.100.100`), `systemd-resolved` adds that address to the backup file. Later, when Tailscale re-reads the backup to find upstream DNS servers, it forwards queries to itself, creating a loop that breaks DNS resolution. This is especially known to occur on Amazon Linux 2023.\r\n\r\nA workaround to this issue is to reconfigure `systemd-resolved` from Amazon's legacy mode to stub resolver mode by masking Amazon's custom configuration and pointing `/etc/resolv.conf` to the stub resolver.\r\n\r\n```shell\r\nmkdir -p /etc/systemd/resolved.conf.d\r\nln -sf /dev/null /etc/systemd/resolved.conf.d/resolved-disable-stub-listener.conf\r\nln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf\r\n```\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"<h1>Configuring Linux DNS</h1>\n<p>Last validated: Jan 5, 2026</p>\n<p>There are <a href=\"https://tailscale.com/blog/sisyphean-dns-client-linux\">an incredible number of ways</a> to configure DNS on Linux.</p>\n<p>Tailscale attempts to interoperate with any Linux DNS configuration it\r\nfinds already present. Unfortunately, some are not entirely amenable\r\nto cooperatively managing the host's DNS configuration.</p>\n<h2><a href=\"https://tailscale.com/docs/reference/linux-dns#common-problems\">Common problems</a></h2>\n<h3><a href=\"https://tailscale.com/docs/reference/linux-dns#networkmanager--systemd-resolved\">NetworkManager + systemd-resolved</a></h3>\n<p>If you're using both NetworkManager and systemd-resolved (as in\r\ncommon in many distros), you'll want to make sure that\r\n<code>/etc/resolv.conf</code> is a symlink to\r\n<code>/run/systemd/resolve/stub-resolv.conf</code>. That should be the\r\ndefault. If not,</p>\n<pre><code class=\"language-shell\">sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf\n</code></pre>\n<p>When NetworkManager sees that symlink is present, its default behavior\r\nis to use systemd-resolved and not take over the resolv.conf file.</p>\n<p>After fixing, restart everything:</p>\n<pre><code class=\"language-shell\">sudo systemctl restart systemd-resolved\r\nsudo systemctl restart NetworkManager\r\nsudo systemctl restart tailscaled\n</code></pre>\n<h3><a href=\"https://tailscale.com/docs/reference/linux-dns#dhcp-dhclient-overwriting-etcresolvconf\">DHCP <code>dhclient</code> overwriting <code>/etc/resolv.conf</code></a></h3>\n<p>Without any DNS management system installed, DHCP clients like\r\n<code>dhclient</code> and programs like <code>tailscaled</code> have no other options than\r\nrewriting the <code>/etc/resolv.conf</code> file themselves, which results in\r\nthem sometimes fighting with each other. (For instance, a DHCP renewal\r\nrewriting the <code>resolv.conf</code> resulting in loss of MagicDNS functionality.)</p>\n<p>Possible workarounds are to use <code>resolvconf</code> or <code>systemd-resolved</code>.\r\n<a href=\"https://github.com/tailscale/tailscale/issues/2334\">Issue 2334</a> tracks making Tailscale react to other\r\nprograms updating <code>resolv.conf</code> so Tailscale can add itself back.</p>\n<h3><a href=\"https://tailscale.com/docs/reference/linux-dns#dns-issues-with-amazon-linux\">DNS issues with Amazon Linux</a></h3>\n<p>On Amazon Linux, Tailscale's DNS can break due to an infinite forwarding loop. When Tailscale backs up and replaces <code>/etc/resolv.conf</code> with its own DNS server (<code>100.100.100.100</code>), <code>systemd-resolved</code> adds that address to the backup file. Later, when Tailscale re-reads the backup to find upstream DNS servers, it forwards queries to itself, creating a loop that breaks DNS resolution. This is especially known to occur on Amazon Linux 2023.</p>\n<p>A workaround to this issue is to reconfigure <code>systemd-resolved</code> from Amazon's legacy mode to stub resolver mode by masking Amazon's custom configuration and pointing <code>/etc/resolv.conf</code> to the stub resolver.</p>\n<pre><code class=\"language-shell\">mkdir -p /etc/systemd/resolved.conf.d\r\nln -sf /dev/null /etc/systemd/resolved.conf.d/resolved-disable-stub-listener.conf\r\nln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf\n</code></pre>\n<p><img src=\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\" alt=\"Project Logo\"></p>\n<p>Ask AI</p>\n<p>reCAPTCHA</p>\n<p>Recaptcha requires verification.</p>\n<p>protected by <strong>reCAPTCHA</strong></p>\n"}