Chapter 18. Using different DNS servers for different domains

Procedure

1. Install the dnsmasq package:

   # dnf install dnsmasq

   Copy to Clipboard Toggle word wrap

2. Edit the /etc/NetworkManager/NetworkManager.conf file, and set the following entry in the [main] section:

   dns=dnsmasq

   Copy to Clipboard Toggle word wrap

3. Reload the NetworkManager service:

   # systemctl reload NetworkManager

   Copy to Clipboard Toggle word wrap

Verification

1. Search in the systemd journal of the NetworkManager unit for which domains the service uses a different DNS server:

   # journalctl -xeu NetworkManager
   ...
   Jun 02 13:30:17 <client_hostname>_ dnsmasq[5298]: using nameserver 198.51.100.7#53 for domain example.com
   ...

   Copy to Clipboard Toggle word wrap

2. Use the tcpdump packet sniffer to verify the correct route of DNS requests:

   1. Install the tcpdump package:

      # dnf install tcpdump

      Copy to Clipboard Toggle word wrap

   2. On one terminal, start tcpdump to capture DNS traffic on all interfaces:

      # tcpdump -i any port 53

      Copy to Clipboard Toggle word wrap

   3. On a different terminal, resolve host names for a domain for which an exception exists and another domain, for example:

      # host -t A www.example.com
      # host -t A www.redhat.com

      Copy to Clipboard Toggle word wrap

   4. Verify in the tcpdump output that Red Hat Enterprise Linux sends only DNS queries for the example.com domain to the designated DNS server and through the corresponding interface:

      ...
      13:52:42.234533 tun0   Out IP server.43534 > 198.51.100.7.domain: 50121+ A? www.example.com. (33)
      ...
      13:52:57.753235 enp1s0 Out IP server.40864 > 192.0.2.1.domain: 6906+ A? www.redhat.com. (33)
      ...

      Copy to Clipboard Toggle word wrap

      Red Hat Enterprise Linux sends the DNS query for www.example.com to the DNS server on 198.51.100.7 and the query for www.redhat.com to 192.0.2.1.

Troubleshooting

1. Verify that the nameserver entry in the /etc/resolv.conf file refers to 127.0.0.1:

   # cat /etc/resolv.conf
   nameserver 127.0.0.1

   Copy to Clipboard Toggle word wrap

   If the entry is missing, check the dns parameter in the /etc/NetworkManager/NetworkManager.conf file.

2. Verify that the dnsmasq service listens on port 53 on the loopback device:

   # ss -tulpn | grep "127.0.0.1:53"
   udp  UNCONN 0  0    127.0.0.1:53   0.0.0.0:*    users:(("dnsmasq",pid=7340,fd=18))
   tcp  LISTEN 0  32   127.0.0.1:53   0.0.0.0:*    users:(("dnsmasq",pid=7340,fd=19))

   Copy to Clipboard Toggle word wrap

   If the service does not listen on 127.0.0.1:53, check the journal entries of the NetworkManager unit:

   # journalctl -u NetworkManager

   Copy to Clipboard Toggle word wrap