resolvectl
who this host really asksOn a systemd machine /etc/resolv.conf usually names only 127.0.0.53, a local stub. resolvectl shows what lies behind it: the real resolvers, per interface, and which link a given name will be sent to. With a VPN up there are two sets of DNS servers at once, and this is the only place that says so.
Name resolution on a modern host is per link, not per machine — the question is which interface gets the query.
At the terminal
Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.
What the numbered lines are telling you
A minus means off. Here multicast names, LLMNR and DNS-over-TLS are all disabled, and answers are not DNSSEC-validated.
Applications are told to ask 127.0.0.53, and systemd-resolved forwards from there. The real servers never appear in the file.
eth0 learned 192.168.1.1 from DHCP. "Current" is the one in use when several are listed.
~corp.example sends names under corp.example to the VPN's resolver and nothing else. Without the tilde it would also be a search suffix.
Switches
A switch changes how the command behaves. These are the ones used day to day; man resolvectl lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.
-t TYPE- With query, ask for a record type such as MX or TXT.
-i IFACE- Limit the command to one interface.
-4- Resolve to IPv4 addresses only.
-6- Resolve to IPv6 addresses only.
--no-pager- Print straight to the terminal instead of opening a pager.
Variations worth knowing
The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.
resolvectl query example.comResolves a name the way an application would, and reports which link and protocol answered.
resolvectl flush-cachesEmpties the local cache — the step to take after changing a record and still seeing the old answer.
resolvectl dns eth0 192.0.2.53Sets the resolver for one link until the next network change.
resolvectl statisticsCache hits and misses, and how many answers passed or failed DNSSEC validation.
In cybersecurity
The resolver a host uses sees every name it looks up and can answer with any address it likes. Knowing exactly which one that is matters more than which firewall is in front.
With a VPN up, queries for public names may still go out of eth0 to the local network's resolver. The per-link view shows it.
Any network that hands out a lease also hands out a DNS server. On untrusted Wi-Fi, that is the network operator's choice, not yours.
Both answer names by asking the whole segment, and anyone may reply. Disable them where they are not needed.
DNSOverTLS=yes encrypts queries to the resolver, hiding them from the local network — though not from the resolver.
DNSSEC=no means forged answers are accepted without complaint. Know which of your hosts validate.
A bad answer is cached for its whole TTL. Flushing is part of cleaning up after a DNS incident.