systemd-resolved DNS-over-TLS: Detecting Silent Downgrade in Opportunistic Mode

Answer

Yes. When DNSOverTLS=opportunistic is set, systemd‑resolved will first try a TLS‑based query (port 853). If the TLS handshake or the certificate validation fails, the daemon immediately retries the same query over plain UDP/TCP (port 53). The application receives no error; the downgrade is silent.

Confirmed facts

• systemd‑resolved logs TLS failures to the system journal with messages such as DNS over TLS failed: certificate verify failed or DNS over TLS failed: handshake failed.
• After a failure, resolvectl status shows the server’s DNSOverTLS state as opportunistic but the Connection column switches to plain for that server.
• Network captures reveal that queries to the affected server are sent over UDP/TCP port 53 immediately after a TLS failure, confirming the fallback.
• Per‑link DnsOverTLS= overrides the global value. If a link explicitly sets opportunistic or no, that link’s behavior can differ from the global setting.

Likely explanation

The opportunistic mode is intentionally designed to avoid breaking connectivity. A transient TLS error is treated the same as a resolver that never advertised DoT, so the daemon keeps the service available. The design choice keeps the user experience seamless at the cost of a silent loss of confidentiality.

Detecting a silent downgrade

1. Check effective mode per interface:

   resolvectl status eth0
   

   Look for DNSOverTLS: opportunistic and the Connection state for each server.

2. Inspect the journal for TLS failures:

   journalctl -u systemd-resolved | grep -i "DNS over TLS failed"
   

   Each line indicates a handshake or certificate error that triggered a fallback.

3. Capture traffic:

   sudo tcpdump -i eth0 -n -s0 -v port 53 or port 853
   

   Verify that after a logged TLS failure the next packets for that server use port 53 instead of 853.

4. Confirm no per‑link override:

   nmcli con show eth0 | grep DNSOverTLS
   

   Ensure the value matches the global DNSOverTLS= in /etc/systemd/resolved.conf.

Enforcing consistent DoT across all resolvers

• Set DNSOverTLS=opportunistic globally in /etc/systemd/resolved.conf and restart systemd-resolved.

  sudo systemctl restart systemd-resolved
  

• Remove or align any per‑link DnsOverTLS= settings in NetworkManager or systemd-networkd configurations.

  nmcli con modify eth0 +ipv4.dns-over-tls "opportunistic"
  

• After changes, run resolvectl status on every interface to confirm the same Connection state for all configured servers.

Missing diagnostic detail

Do you know which systemd version is running on the host? The log wording and retry intervals for DoT failures differ between releases, which can affect how you interpret journal entries.