Skip to content

DNS caching in Amazon Linux 2023

1

I am trying to figure out how to cache DNS queries on EC2 machine running Amazon Linux 2023 as for my usage there are too many repeated queries to APIs which causes very high GuardDuty bill and could be faster.

There is a guide for dnsmasq usage, but it isn't working as there is no dhclient present on AL2023.

AL2023 uses systemd resolved, but seems that dnsstublistener is turned off (/usr/lib/systemd/resolved.conf.d/resolved-disable-stub-listener.conf states "Amazon Linux systems do not use the stub listener by default, so we disable it in order to reduce the runtime footprint and to avoid triggering https://bugzilla.redhat.com/show_bug.cgi?id=2115094") and I'm unable to turn it on in nice way, even /run/systemd/resolve/stub-resolv.conf doesn't contain a valid dns records for 127.0.0.53 and enabling dns stubs in /etc/resolv.conf gives no effect.

What would be the correct way to cache DNS queries locally on AL2023 ec2 machines?

asked 2 years ago2.4K views

2 Answers
0

Setting Up DNS Caching on Amazon Linux 2023 with dnsmasq

On Amazon Linux 2023, the default DNS handling has moved to systemd-resolved, and the stub listener is disabled by default. To enable local DNS caching efficiently, follow these steps:

  1. Use dnsmasq:

    • Install dnsmasq:
      sudo yum install dnsmasq
    • Configure dnsmasq to act as a caching server. Add this to /etc/dnsmasq.conf:
      cache-size=1000
      listen-address=127.0.0.1
    • Start and enable the service:
      sudo systemctl enable dnsmasq
      sudo systemctl start dnsmasq
  2. Point /etc/resolv.conf to dnsmasq:

    • Edit /etc/resolv.conf to use the local DNS cache:
      nameserver 127.0.0.1
  3. Ensure persistence: To prevent changes to /etc/resolv.conf from being overwritten by network configuration:

    • Use the resolvconf tool or create a static file:
      sudo chattr +i /etc/resolv.conf

Alternatively, you can stick to systemd-resolved and manually enable the DNS stub listener. However, given Amazon Linux's configuration, dnsmasq offers a simpler and more predictable setup.

Let me know if you'd like further clarification!

Cheers, Aaron 😊

answered a year ago

0
AWS

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.