How Resolv.conf Defines Nameservers in Linux

This article explains how the /etc/resolv.conf file configures Domain Name System (DNS) nameservers in the Linux operating system. It covers the core syntax, how the system resolver processes nameserver entries, the behavior of failover mechanisms, and the impact of modern network managers on this configuration file.

The Role of /etc/resolv.conf

In Linux, human-readable hostnames (such as example.com) are translated into IP addresses by a set of routines in the standard C library known as the resolver. The /etc/resolv.conf file acts as the central configuration file for this resolver, explicitly defining which DNS servers the operating system should query.

The nameserver Directive

The primary mechanism for specifying a DNS server is the nameserver directive followed by the IPv4 or IPv6 address of the target server:

nameserver 8.8.8.8
nameserver 1.1.1.1
nameserver 2001:4860:4860::8888

Each nameserver line tells the resolver where to send DNS queries. The resolver evaluates these entries based on strict rules:

• Sequential Priority: The resolver queries nameservers in the order they appear from top to bottom. It sends the request to the first nameserver on the list.
• Failover, Not Load Balancing: If the first nameserver responds—even with a "host not found" (NXDOMAIN) error—the resolver accepts the response and does not contact subsequent servers. Secondary and tertiary nameservers are only queried if the primary server fails to respond (times out) or encounters a network-level transmission error.
• The Three-Server Limit: By default, the GNU C Library (glibc) resolver reads a maximum of three nameserver directives. Any nameservers defined beyond the third entry are ignored by default.

Supporting Directives

While nameserver specifies the target IPs, additional directives alter how queries are routed to those servers:

• search and domain: Define domain search lists for resolving bare hostnames. For example, with search example.com, querying server1 causes the resolver to attempt to look up server1.example.com against the defined nameservers.
• options: Modifies resolver behavior. Useful options include:
  • rotate: Enables round-robin selection of nameservers to distribute query load across all listed servers.
  • timeout:n: Sets the time (in seconds) the resolver waits for a response before trying the next nameserver.
  • attempts:n: Sets the number of times the resolver queries a nameserver before moving to the next.

Modern Implementations: Dynamic Management

In modern Linux distributions, /etc/resolv.conf is rarely edited by hand. Services such as NetworkManager, systemd-resolved, or DHCP clients dynamically generate this file based on active network interfaces.

When using systemd-resolved, /etc/resolv.conf is frequently a symbolic link pointing to /run/systemd/resolve/stub-resolv.conf. In this scenario, the file points to a local stub listener:

nameserver 127.0.0.53

In this architecture, the standard resolver sends queries to the local loopback address (127.0.0.53), and the systemd-resolved daemon takes over the responsibility of routing those queries to the actual upstream nameservers defined per network link.