technitiumdns Delete Edit

Install

• yay -S technitium-dns-server-bin
• systemctl disable --now systemd-resolved.service
• systemctl enable --now technitium-dns-server.service

Configuration

• Open up the webui at http://IP:5380
• Set new admin password
• Settings
  • General
    • set the DNS Server Domain
  • Proxy & Forwarders
    • set some Forwarders

acme certificate in pcks12 format

Note! These optional DNS Server protocol changes will be automatically applied and so you do not need to manually restart the main service. The TLS certificate too will be automatically reloaded when the certificate file’s date modified property on disk changes.

• install acme.sh and socat
  • pacman -S acme.sh socat
• [optional] install custom ca cert

  • mkdir /etc/lairlan
    mv ~/lairlan.internal.root.crt /etc/lairlan/

• create systemd service

  • cat >> /etc/systemd/system/acme_cert.service << EOF
    # /etc/systemd/system/acme_cert.service
    [Unit]
    Description=Renew internal certificates using acme.sh
    After=network-online.target
    
    [Service]
    Type=oneshot
    Environment=CERT_PFX_PATH=/opt/technitium-dns-server/config/certs/techdns.lair.lan.pfx
    ExecStart=/usr/bin/acme.sh --issue --standalone -d techdns.lair.lan,10.193.120.5 --server https://ca.lair.lan/acme/lairlan/directory --ca-bundle /etc/lairlan/lairlan.internal.root.crt --fullchain-file /opt/technitium-dns-server/config/certs/fullchain.pem --key-file /opt/technitium-dns-server/config/certs/key.pem --force
    ExecStart=/usr/bin/acme.sh --issue -d techdns.lair.lan --to-pkcs12 --password "CHANGEME" --reloadcmd "/usr/bin/chown technitium:technitium /opt/technitium-dns-server/config/certs/techdns.lair.lan.pfx"
    EOF

• create systemd timer

  • cat >> /etc/systemd/system/acme_cert.timer << EOF
    # /etc/systemd/system/acme_cert.timer
    [Unit]
    Description=Renew internal certificates using acme.sh
    
    [Timer]
    Persistent=true
    OnBootSec=120
    OnUnitActiveSec=7d
    AccuracySec=1m
    RandomizedDelaySec=1m
    
    [Install]
    WantedBy=timers.target
    EOF

• reload systemd and install timer

  • systemctl daemon-reload
    systemctl enable --now acme_cert.timer

• Goto Technitium webui and enable
  • Settings
    • Web Service
      • HTTPS Options
        • Enable HTTPS Checked
        • Enable HTTP to HTTPS Redirection (After testing HTTPS enable this)
      • TLS Certificate File Path (This is only available AFTER checking Enable HTTPS!)
        • certs/techdns.lair.lan.pfx
      • TLS Certificate Password
        • CHANGEME

From here on, it’s basic dns zones stuff and TSIGs etc

dig -x <IP>
dig somedomain.tld
dig somedomain.tld @8.8.8.8 # check somedomain.tld with googles dns server

here is ads.google.com as an example that is blocked by multiple lists

; <<>> DiG 9.20.11 <<>> +all ads.google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 28414
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; EDE: 15 (Blocked): (source=block-list-zone; blockListUrl=https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts; domain=ads.google.com)
; EDE: 15 (Blocked): (source=block-list-zone; blockListUrl=https://adaway.org/hosts.txt; domain=ads.google.com)
; EDE: 15 (Blocked): (source=block-list-zone; blockListUrl=https://raw.githubusercontent.com/bigdargon/hostsVN/master/hosts; domain=ads.google.com)
; EDE: 15 (Blocked): (source=block-list-zone; blockListUrl=https://blocklistproject.github.io/Lists/ads.txt; domain=ads.google.com)
; EDE: 15 (Blocked): (source=block-list-zone; blockListUrl=https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-social/hosts; domain=ads.google.com)
;; QUESTION SECTION:
;ads.google.com.                        IN      A

;; AUTHORITY SECTION:
google.com.             30      IN      SOA     techdns.lair.lan. hostadmin.techdns.lair.lan. 1 14400 3600 604800 30

;; Query time: 1 msec
;; SERVER: 10.193.120.5#53(10.193.120.5) (UDP)
;; WHEN: Mon Jul 21 23:02:54 CEST 2025
;; MSG SIZE  rcvd: 730