Skip to main content
Ubuntu, Debian, Fedora and many other distributions run systemd-resolved, which already listens on 127.0.0.53:53. DNZ then can’t bind 0.0.0.0:53:
See what’s using the port:
1

Turn off systemd-resolved's stub listener

2

Repoint /etc/resolv.conf

/etc/resolv.conf usually points at the 127.0.0.53 stub, which no longer exists. Point it at systemd-resolved’s real DNS list, so this server can still resolve names itself (apt update, curl and so on):
Skip this and the server can no longer resolve any name once the stub is off.
3

Restart systemd-resolved, then DNZ

4

Check

Want this server to use DNZ as its own resolver? Put DNS=127.0.0.1 in /etc/systemd/resolved.conf.d/dnz.conf and restart systemd-resolved. If you use encrypted upstreams, add #ip to them to avoid a loop; see upstream addresses.

​
Option 2: bind DNZ to one address

Leave systemd-resolved alone and listen only on the server’s LAN address:
/etc/dnz/dnz.env
With Docker, publish the port on that address instead:

​
Other programs on port 53

dnsmasq, bind9, unbound and pihole-FTL use port 53 too. Stop that program, for example sudo systemctl disable --now dnsmasq, or bind DNZ to another address.