Setting dns over TLS on ubuntu 26.04 using quad9 and

With this change future dns queries should got to Quad9 and fallback Cloudflare if Quad9 has a outage, and should go over TLS. 

Change /etc/systemd/resolved.conf 

[Resolve]
DNS=9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net
FallbackDNS=1.1.1.1#one.one.one.one 1.0.0.1#one.one.one.one
DNSOverTLS=yes
DNSSEC=allow-downgrade
Cache=yes

Run this to create a config file for NetworkManager for future connections.

sudo tee /etc/NetworkManager/conf.d/ignore-dhcp-dns.conf << 'EOF'
[main]
dns=systemd-resolved

[connection]
ipv4.ignore-auto-dns=yes
ipv6.ignore-auto-dns=yes
EOF

 

# run this to fix existing connections in Network Manager 

for uuid in $(nmcli -t -f UUID connection show); do
  sudo nmcli connection modify "$uuid" ipv4.ignore-auto-dns yes ipv6.ignore-auto-dns yes
done

sudo nmcli connection reload

sudo nmcli networking off

sudo nmcli networking on

sudo systemctl restart NetworkManager systemd-resolved

resolvectl status