---
name: zerotier-managed-dns
description: "How ZeroTier managed DNS (wrede.pvt over ZT) is wired on Linux hosts — zerotier-systemd-manager + networkd, NOT native ZT"
metadata: 
  node_type: memory
  type: reference
  originSessionId: 0f399db0-9a91-4f55-b102-70875f05be7a
---

ZeroTier network `d3ecf5726d041b2a` ("suspicious_house", iface `ztuga7c2kh`, 192.168.196.0/24) pushes managed DNS: domain `wrede.pvt`, servers `192.168.196.115` + `192.168.10.5`. Goal: when a host is AWAY from the home LAN, `*.wrede.pvt` resolves over ZeroTier.

**GOTCHA: ZeroTier's native DNS push is a no-op on Linux.** `journalctl -u zerotier-one` shows `WARNING: ignoring call to LinuxEthernetTap::setDns on Linux. This is not implemented yet` (ZeroTierOne#2492). So `zerotier-cli set <nwid> allowDNS=1` alone does NOTHING for resolution on Linux — it's only the prerequisite that lets the pushed DNS appear in network config.

**Actual mechanism = `zerotier-systemd-manager`** (Go binary, hand-installed — NOT in the zerotier apt repo; v0.4.0 at /usr/bin/zerotier-systemd-manager). It reads ZT networks and generates `/etc/systemd/network/99-<ztdev>.network` with `DNS=` + `Domains=~wrede.pvt ~<reverse zones>`, then reloads systemd-networkd which applies it to systemd-resolved. Ships a `.service` (oneshot) + `.timer` (regenerates every 1 min) in /usr/lib/systemd/system/. Requires systemd-networkd enabled+active.

Setup recipe (done on wertvoll, replicated on wayback 2026-06-28):
1. `zerotier-cli set d3ecf5726d041b2a allowDNS=1` (writes networks.d/<nwid>.local.conf).
2. Install zerotier-systemd-manager (copy binary + 2 unit files; both hosts amd64). `systemctl enable --now zerotier-systemd-manager.timer`.
3. Ensure systemd-networkd enabled+active.
4. Optional bare-hostname search: drop-in `99-<ztdev>.network.d/search.conf` making `wrede.pvt` a SEARCH domain (no `~`).
Verify: `resolvectl status <ztdev>` → Current Scopes: DNS, the 2 servers, `DNS Domain: wrede.pvt ~rev…`. On-home-LAN it still prefers the LAN link for wrede.pvt (both have the domain) — that's correct; ZT is the path when off-LAN.

wayback-specific: see [[wayback-campervan-ap]]. wayback's `search.conf` uses `Domains=` (reset) then `Domains=wrede.pvt ~196.168.192.in-addr.arpa ~c.e.3.d.d.f.ip6.arpa` because wertvoll's plain `Domains=wrede.pvt` drop-in did NOT merge on wayback (same systemd 255 — cause unknown); the reset form yields the identical resolved result. An empty `/etc/NetworkManager/conf.d/10-globally-managed-devices.conf` was briefly added to match wertvoll, then REMOVED — confirmed not needed (removing it left ZT DNS fully working, since networkd not NM drives it). wertvoll still has it but it's incidental.