resolvconf is a loose convention for assembling DNS settings from multiple inputs. NetworkManager is a fuller network manager with a D-Bus API and optional dnsmasq mode for split DNS. systemd-resolved is a resolver service with per-interface control and richer routing behavior. The key distinction is how much policy each one can express and override.
What each component is actually doing
These tools sit at different layers of the DNS stack. resolvconf is mainly a convention for collecting resolver settings from multiple sources and writing them into a resolver configuration that other software can consume. NetworkManager is a broader network control plane that can own links, policy, and DNS behavior together. systemd-resolved is a resolver service that actively answers queries and can apply per-link routing and split-DNS decisions.
The practical difference is not just “who writes /etc/resolv.conf”, but who can express policy. resolvconf is mostly about aggregation. NetworkManager can decide which connection wins, which DNS servers to use, and when to hand off to a local caching resolver. systemd-resolved can keep different DNS contexts per interface, which matters when one network should only resolve some domains.
Why the policy model matters in real environments
The more policy a component owns, the more it can reduce ambiguity, but also the more it can surprise you if you assume a simple static resolv.conf model. IANA maintains the protocol parameter registries that underpin DNS and related Internet coordination, but the local resolver stack still determines how those inputs are assembled and applied on a host.
That distinction shows up in multi-homed systems, VPNs, and laptops that move between networks. A plain resolver assembly approach is usually enough when the host has one trusted DNS path and no split-routing requirements. A network manager or resolver service becomes more useful when the host must choose DNS servers dynamically, keep per-interface search behavior separate, or avoid leaking internal names to the wrong upstream.
systemd-resolved is often the most capable option when the question is “which DNS server should answer this name on this interface?” NetworkManager is often the most capable when DNS is only one part of a broader connection lifecycle, including link state, VPN policy, and address assignment. resolvconf is the lightest-weight pattern when you want coordination without handing policy to a full network daemon.
How to choose between them without creating DNS conflicts
The main design choice is whether you want a single source of truth or a layering model. If NetworkManager controls the link and also manages DNS, then adding another component that rewrites resolver state can create churn unless roles are clearly separated. If systemd-resolved is present, it is usually best to let it own resolution behavior rather than treating it as a passive cache. If resolvconf is used, make sure it is not fighting with a second writer.
A useful mental model is: resolvconf assembles, NetworkManager orchestrates, and systemd-resolved resolves. In practice, distributions mix these roles differently, so the correct answer is often determined by which service is authoritative on your system and which one owns the resolver stub or symlink path.
When split DNS is required, the important detail is not the name of the component but whether it can keep routing separate by interface or connection. If it cannot, internal and external lookups may end up using the same upstream path, which is both a correctness problem and, in some environments, a confidentiality problem.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.DS-01 — Data-at-Rest Protected | DNS configuration integrity affects how hosts protect and route name-resolution data. |
| Recommendation — Ensure resolver configuration changes are controlled and monitored. | ||
| NIST SP 800-53 Rev 5 | CM-6 — Configuration Settings | This question is fundamentally about how DNS behavior is configured and overridden on a host. |
| Recommendation — Define one authoritative resolver configuration and enforce it consistently. | ||
| ISO/IEC 27001:2022 | A.8.9 — Configuration management | Resolver ownership and override behavior are configuration-management concerns on endpoints and servers. |
| Recommendation — Document and control which service is allowed to manage DNS settings. | ||
Practitioner Guidance
What to verify: Check which process is actually managing /etc/resolv.conf, which daemon is supplying upstream servers, and whether VPN or per-interface DNS settings are being preserved or flattened. If you see unexpected name resolution, verify the live resolver path before changing DNS entries by hand.
Decision rule: If you need simple DNS assembly, keep the stack minimal. If you need connection-aware DNS policy, let NetworkManager manage the link and policy. If you need per-interface resolution behavior, prefer systemd-resolved as the component that makes the final routing decision.
Common mistake: Treating these tools as interchangeable because they all “deal with DNS.” They do not. The failure mode is usually overlap, where one service silently overwrites another or a static edit is discarded on the next network event.
Practitioner takeaway: The right choice is the one that leaves exactly one component authoritative for DNS policy on the host, because predictable resolution depends more on clear ownership than on the specific daemon name.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 1, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org