> ## Documentation Index > Fetch the complete documentation index at: https://siderolabs-fe86397c-config-evolution.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Resolvers > Learn how to configure DNS resolvers. export const VersionWarningBanner = () => { const latestVersion = "v1.13"; const [latestUrl, setLatestUrl] = useState(null); const [currentVersion, setCurrentVersion] = useState(null); const [isBeta, setIsBeta] = useState(false); const parseVersion = v => v.replace("v", "").split(".").map(Number); const isGreaterVersion = (a, b) => { const [aMajor, aMinor] = parseVersion(a); const [bMajor, bMinor] = parseVersion(b); if (aMajor > bMajor) return true; if (aMajor === bMajor && aMinor > bMinor) return true; return false; }; useEffect(() => { if (typeof window === "undefined") return; const {pathname, hash, search} = window.location; const match = pathname.match(/\/talos\/(v\d+\.\d+)\//); if (!match) return; const detectedVersion = match[1]; if (detectedVersion === latestVersion) return; setCurrentVersion(detectedVersion); if (isGreaterVersion(detectedVersion, latestVersion)) { setIsBeta(true); } const newPath = pathname.replace(`/talos/${detectedVersion}/`, `/talos/${latestVersion}/`); setLatestUrl(`${newPath}${search}${hash}`); }, []); if (!latestUrl || !currentVersion) return null; return
{isBeta ? <> ⚠️ You are viewing a beta version of Talos ({currentVersion}). This version may be unstable. View latest stable version {latestVersion} → : <> ⚠️ You are viewing an older version of Talos ({currentVersion}). View the latest version {latestVersion} → }
; }; DNS resolvers are used by Talos to resolve domain names into IP addresses. By default, Talos will use DNS resolvers `8.8.8.8` and `1.1.1.1`, and DNS servers might be provided via DHCP or cloud platform metadata. ## Configuration To configure custom DNS resolvers, create a [ResolverConfig](../../reference/configuration/network/resolverconfig) document like this: ```yaml theme={null} apiVersion: v1alpha1 kind: ResolverConfig nameservers: - address: 10.0.0.1 - address: 2001:4860:4860::8888 searchDomains: # optional domains: - example.org - example.com disableDefault: false ``` The `nameservers` field is a list of DNS server IP addresses that Talos will use for DNS resolution. The `searchDomains` field allows you to specify search domains that will be appended to unqualified domain names during DNS resolution, the default search domains is to use the domain part of the machine's hostname. The `disableDefault` field, when set to `true`, prevents Talos from using the default search domains derived from the machine's hostname. See [Host DNS](../host-dns) for more information about DNS resolution in Talos. ## Encrypted DNS (DoT and DoH) Each nameserver can be queried over an encrypted transport instead of plain DNS, by setting the `protocol` and `tlsServerName` fields: ```yaml theme={null} apiVersion: v1alpha1 kind: ResolverConfig hostDNS: enabled: true nameservers: - address: 1.1.1.1 protocol: DoH tlsServerName: cloudflare-dns.com - address: 9.9.9.9 protocol: DoT tlsServerName: dns.quad9.net ``` The `protocol` field accepts: * `Do53` (the default): plain DNS over UDP/TCP port `53`. * `DoT`: [DNS over TLS](https://datatracker.ietf.org/doc/html/rfc7858) over TCP port `853`. * `DoH`: [DNS over HTTPS](https://datatracker.ietf.org/doc/html/rfc8484) over TCP port `443`. The `tlsServerName` field is required for `DoT` and `DoH`, and must be empty for `Do53`. The `address` field always stays an IP address: Talos connects to that address directly, and `tlsServerName` is only used as the TLS SNI and the name verified against the server certificate (and, for `DoH`, as the host part of the request URL `https:///dns-query`), so encrypted DNS never needs a bootstrap resolver. The protocol is configured per nameserver, so plain and encrypted nameservers can be mixed in a single `ResolverConfig`. Encrypted DNS is implemented by the host DNS caching resolver, so `hostDNS.enabled` must be `true`; a configuration which uses `DoT` or `DoH` without host DNS is rejected. See [Host DNS](../host-dns#encrypted-upstream-dns-dot-and-doh) for the way encrypted upstreams are used, and for the interaction with time synchronization. ## Observing status Use `talosctl` to get the current resolver configuration of a node: ```bash theme={null} talosctl get resolvers ``` ```text theme={null} NODE NAMESPACE TYPE ID VERSION RESOLVERS SEARCH DOMAINS 172.20.0.2 network ResolverStatus resolvers 4 ["172.20.0.1"] [] ``` The `RESOLVERS` column only lists the nameserver addresses; the protocol and TLS server name of each nameserver are visible in the full resource: ```bash theme={null} talosctl get resolvers -o yaml ``` ```yaml theme={null} # ... spec: dnsServers: - 1.1.1.1 - 9.9.9.9 nameServers: - addr: 1.1.1.1 protocol: DoH tlsServerName: cloudflare-dns.com - addr: 9.9.9.9 protocol: DoT tlsServerName: dns.quad9.net searchDomains: [] ``` To see all resolver configuration sources, use the following: ```bash theme={null} talosctl get resolverspec --namespace=network-config ``` ```text theme={null} NODE NAMESPACE TYPE ID VERSION LAYER RESOLVERS SEARCH DOMAINS 172.20.0.2 network-config ResolverSpec default/resolvers 1 default ["1.1.1.1","8.8.8.8"] 172.20.0.2 network-config ResolverSpec dhcp4/enp0s2/resolvers 1 operator ["172.20.0.1"] ```