ZDNET Shows Ubuntu Users How to Set DNS With 2 Netplan IP Addresses

Q: How can you permanently stop NetworkManager from overriding your custom DNS settings on Ubuntu?

The most reliable way is to tell NetworkManager to stop managing DNS entirely. On Ubuntu, add a custom config file such as `/etc/NetworkManager/conf.d/90-custom-dns.conf` with: ```ini [main] dns=none rc-manager=unmanaged ``` Then restart NetworkManager with `sudo systemctl restart NetworkManager`. This prevents it from rewriting `/etc/resolv.conf` or overriding the DNS servers you set through Netplan or manually. If you are using Netplan, keep your DNS servers in the relevant `/etc/netplan/*.yaml` file under `nameservers:` and apply them with `sudo netplan apply`. On systems where NetworkManager still interferes with a specific interface, you can mark that interface unmanaged in `/etc/NetworkManager/conf.d/99-unmanaged-devices.conf`, or disable NetworkManager entirely if you do not need it. A more forceful fallback is to make `/etc/resolv.conf` immutable with `sudo chattr +i /etc/resolv.conf` after writing your desired nameservers there. That blocks any process, including NetworkManager, from changing it, though it is less flexible because you must remove the immutable flag before editing again. For most Ubuntu systems, the clean permanent fix is the NetworkManager config change plus Netplan-managed DNS, followed by verification with `resolvectl status`.

Q: How do you activate encrypted DNS-over-TLS on Ubuntu 26.04 using only the command line for enhanced privacy?

Use `systemd-resolved`, not Netplan alone. On Ubuntu 26.04, the command-line way to enable encrypted DNS-over-TLS is to point `systemd-resolved` at DoT-capable resolvers and turn DoT on. Create a drop-in config so package updates do not overwrite it: ```bash sudo mkdir -p /etc/systemd/resolved.conf.d sudo nano /etc/systemd/resolved.conf.d/90-dot.conf ``` Add: ```ini [Resolve] DNS=1.1.1.1#cloudflare-dns.com 1.0.0.1#cloudflare-dns.com FallbackDNS=9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net DNSOverTLS=true Domains=~. ``` The `IP#hostname` format matters because it lets `systemd-resolved` verify the server’s TLS certificate. `DNSOverTLS=true` enforces strict encrypted DNS; if the resolver does not support DoT, lookups will fail rather than fall back to plain DNS. Then restart the resolver: ```bash sudo systemctl restart systemd-resolved ``` Make sure `/etc/resolv.conf` points to the local stub resolver: ```bash ls -l /etc/resolv.conf ``` It should link to `/run/systemd/resolve/stub-resolv.conf`. If not: ```bash sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf ``` Verify it is active: ```bash resolvectl status resolvectl query example.com ``` You should see your chosen DNS servers and `DNSOverTLS: yes`, and the query output should indicate the data was acquired via local or encrypted transport. If NetworkManager keeps overriding DNS, set it to stop managing DNS or use `systemd-resolved` as its DNS backend before retrying.

Q: What fail-safe command prevents you from getting locked out of a remote server after a bad network configuration?

Use `sudo netplan try`. That is the fail-safe command Ubuntu administrators use to avoid locking themselves out of a remote server after a bad network change. Unlike `sudo netplan apply`, which makes the change immediately and permanently, `netplan try` applies the new configuration only temporarily and starts a confirmation timer. If the new settings work, you confirm them and they stay in place. If the configuration breaks networking or kills your SSH session, you do nothing: after the timeout, Netplan automatically rolls back to the previous working setup. The default timeout is typically 120 seconds, and you can set a shorter one, such as `sudo netplan try --timeout 60`. This is especially important when editing Netplan YAML files for DNS, IP, or interface settings on headless or remote Ubuntu systems, where a typo or indentation error can otherwise cut off access.

1 articles · Updated · ZDNet · Jul 20

ZDNET’s latest guide walks Ubuntu users through changing DNS from the command line by editing a Netplan YAML file in /etc/netplan, using Cloudflare’s 1.1.1.1 and 1.0.0.1 as examples.
The method is aimed at systems without a GUI or machines accessed over SSH, and ZDNET says it works on both DHCP and static-IP setups across desktops and servers.
NetworkManager may override desktop DNS settings, so the guide says users can disable that control in NetworkManager.conf and restart the service before applying Netplan changes.
After adding the nameservers section, the guide applies the update with sudo netplan apply and verifies it with ping google.com or resolvectl status, noting YAML indentation errors are the most likely problem.