Bug 2228188

LLMNR is multicast resolution protocol. It is enabled in systemd-resolved since it has become default in f33 and provides Windows compatible resolution of names. It works over multicast on local networks and is potentially insecure. Any machine on the same network link can impersonate any hostname without dot present.

But even Microsoft, which is behind its RFC has announced its deprecation [MS-LLMNR].

Ubuntu server has it disabled in default installation. I think we want that too. We do not want mdns, proposed replacement, enabled on servers by default either.

What is not caused by the protocol itself, but the way systemd-resolved implements it, it directs single label names to LLMNR resolution *only*. So it also answers for queries not really intended for LLMNR resolution [stub-llmnr].

Reproducible: Always

Steps to Reproduce:
1. resolvectl llmnr
2. dig -t ns org.
Actual Results:  
# resolvectl llmnr
Global: resolve
Link 2 (eth0): resolve

# dig -t ns org.

; <<>> DiG 9.18.17 <<>> -t ns org.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 45940
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;org.				IN	NS

;; Query time: 3580 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Tue Aug 01 12:58:27 EDT 2023
;; MSG SIZE  rcvd: 32


Expected Results:  
# resolvectl llmnr
Global: no
Link 2 (eth0): no

# dig -t ns org.

; <<>> DiG 9.18.17 <<>> -t ns org.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18927
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;org.				IN	NS

;; ANSWER SECTION:
org.			3593	IN	NS	b2.org.afilias-nst.org.
org.			3593	IN	NS	b0.org.afilias-nst.org.
org.			3593	IN	NS	c0.org.afilias-nst.info.
org.			3593	IN	NS	d0.org.afilias-nst.org.
org.			3593	IN	NS	a0.org.afilias-nst.info.
org.			3593	IN	NS	a2.org.afilias-nst.info.

;; Query time: 0 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Tue Aug 01 12:59:53 EDT 2023
;; MSG SIZE  rcvd: 170


I have found also reference in cloud-init, disabling it explicitly in systemd-resolved template [init-resolved]. Created also ticket on fedora-server [1].

[MS-LLMNR] https://techcommunity.microsoft.com/t5/networking-blog/aligning-on-mdns-ramping-down-netbios-name-resolution-and-llmnr/ba-p/3290816
[init-resolved] https://github.com/canonical/cloud-init/blob/7cbe0f647737d9adf8635206b68f7fd363d67e0f/templates/systemd.resolved.conf.tmpl#L8
[1] https://pagure.io/fedora-server/issue/114
[stub-llmnr] https://github.com/systemd/systemd/issues/23622