What is systemd-resolved?

The systemd service that handles DNS resolution on modern Ubuntu — the piece you configure to enable DNS-over-TLS.

How it works

It's the local stub resolver your system asks to turn domain names into IPs. You point it at an encrypted resolver and flip on DNSOverTLS to stop DNS lookups leaking in cleartext.

Example

In practiceYou edit resolved.conf to set an encrypted DNS resolver and DNSOverTLS=yes, then restart systemd-resolved.

How do I confirm DoT is working?

Check resolvectl status shows the encrypted resolver, then run a DNS leak test to confirm queries go where you expect.

Go deeper: Build a Hardened Linux Workstation

The complete, step-by-step guide — every command, config, and the reasoning behind it.

Get the guide