Description of problem:
systemd-resolved always (reverse)-resolves the host's IP addresses and FQDN.
This can be harmful when an application (for instance, a DNS zone manager) is installed on the same server instance.
That application would expect NXDOMAIN to be returned if the current server's IP does not belong in an already managed reverse zone.
More details:
https://lists.freedesktop.org/archives/systemd-devel/2021-September/046856.html
How reproducible:
Always, see list post.
Expected results:
Being able to disable the generation of synthetic RRs.
Additional info:
The workarounds described in the mailing-list all imply changing the application in a more or less intrusive or fragile way. Being able to change resolved's behavior in its configuration file would be much more efficient.
Comment 1Zbigniew Jędrzejewski-Szmek
2021-12-14 18:16:12 UTC
resolvectl query has --synthesize=no that filters out synthesized names.
This is implemented via flags in the dbus api, SD_RESOLVED_NO_SYNTHESIZE flag
to org.freedesktop.resolve1.Manager.ResolveHostname(),
org.freedesktop.resolve1.Manager.ResolveAddress().
I guess we could add flag to disable this in nss-resolve. Will this work
for you?