Level 0: resolver Environment

Linux VMs and bare metal

For a VM that runs one agent, set the resolver at the operating system level and disable fallback resolvers.

Configuration and reference code for Linux VMs and bare metal

systemd-resolved

/etc/systemd/resolved.conf.d/securd.conf

[Resolve]
DNS=<primary resolver IP> <secondary resolver IP>
FallbackDNS=
DNSOverTLS=no
Domains=~.

Apply and verify

apply.sh

sudo systemctl restart systemd-resolved
resolvectl status | grep -A2 "DNS Servers"
# Prove the policy answers: a held test name resolves to the block page address
resolvectl query first-seen-test.example

NetworkManager

nm.sh

nmcli con mod "Wired connection 1" ipv4.dns "<primary resolver IP> <secondary resolver IP>" ipv4.ignore-auto-dns yes
nmcli con up "Wired connection 1"

Docker Kubernetes Docker and Compose AWS Google Cloud Azure DoH virtual sites

Evaluate Agent DNS with your own agent traffic

Deploy on a single policy in learning mode and review the recorded destinations with your team.

See It Live View Pricing