What’s the difference between /run/systemd/resolve/stub-resolv.conf and /run/systemd/resolve/resolv.conf

resolv.confsystemd-resolved

For configuring custom DNS servers in a brand new Kubuntu 19.10 laptop it wasn't enough with adding to /etc/systemd/resolved.conf:

DNS=77.88.8.7 77.88.8.3 #Yandex's DNS with no porn even on Google Images

I also had to change the symlink of /etc/resolv.conf

$ ls -l /etc/resolv.conf 
lrwxrwxrwx 1 root root 37 oct 26 01:48 /etc/resolv.conf -> /run/systemd/resolve/stub-resolv.conf
$ sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

/run/systemd/resolve/stub-resolv.conf only has the ISP's given DNSs, while the custom DNSs are only in /run/systemd/resolve/resolv.conf.

When looking at:

man systemd-resolved.service

it says that the recommended file is /run/systemd/resolve/stub-resolv.conf, but I don't get their differences (that understandable and simple explanation should be the accepted answer). If so, how could I set the system to use the globally configured DNSs using that file and not the other?

Note: On laptop, with plenty of WiFi connections, it's not viable to configure a per-connection DNS, like suggested in many sites that says how to achieve this I just described

Additional info for curious:

/run/systemd/resolve/$ diff stub-resolv.conf resolv.conf 
3,8c3,4
< # This is a dynamic resolv.conf file for connecting local clients to the
< # internal DNS stub resolver of systemd-resolved. This file lists all
< # configured search domains.
< #
< # Run "resolvectl status" to see details about the uplink DNS servers
< # currently in use.
---
> # This is a dynamic resolv.conf file for connecting local clients directly to
> # all known uplink DNS servers. This file lists all configured search domains.
17,18c13,17
< nameserver 127.0.0.53
< options edns0
---
> nameserver 77.88.8.7
> nameserver 77.88.8.3
> nameserver 200.49.130.40
> # Too many DNS servers configured, the following entries may be ignored.
> nameserver 200.42.4.207

Best Answer

Using resolv.conf instead of stub-resolv.conf will bypass a lot of systemd-resolved configuration, such as DNS answer caching, per-interface DNS configuration, DNSSec enforcement, etc.

Explanations:

When using stub-resolv.conf, applications will make DNS requests to the DNS stub resolver provided by systemd on address 127.0.0.53. This stub resolver will proxy the DNS requests to the upstream DNS resolvers configured in systemd-resolved, applying whatever logic it wants to those requests and answers, like caching them.

When using resolv.conf, applications will directly make DNS requests to the "real" (aka. upstream) DNS resolvers configured in systemd-resolved. In this case, systemd-resolved only acts as a "resolv.conf manager", not as a DNS resolver itself.

Source: systemd-resolved manpage

Related Question