resolv.conf reverts to old DNS entries

/etc/resolv.conf keeps reverting back to its old entries after updating your DNS server list whether manually or via the setup front-end tool for setting up your Network, authentication, services etc on RHEL or CentOS version 5,6,7.

The solution comes from Redhat's KB article entitled "How to make persistent changes to the /etc/resolv.conf?"https://access.redhat.com/solutions/7412

The issue is that DNS servers in /etc/resolv.conf changed after a reboot or network service restart.

If a single ifcfg-file both specifies a nameserver using DNS1 and also gets a nameserver via DHCP, both nameservers will be placed in resolv.conf.

Root Cause:

- From the script /etc/sysconfig/network-scripts/ifdown-post if the "RESOLV_MODS=no" or "PEERDNS=no" is not present in the relevant /etc/sysconfig/network-scripts/ifcfg-* files, the contents of /etc/resolv.conf could get overwritten with /etc/resolv.conf.save.

- /etc/sysconfig/network-scripts/ifup-post script, checks for the presence of "RESOLV_MODS=no" or "PEERDNS=no"

Resolution:

The change in my situation was due to the ifcfg-eth0 file directives DNS1 and DNS2 which lead to modification of resolv.conf

In my particular situation, the solution was to mark the /etc/resolv.conf as immutable with this command:

chattr +i /etc/resolv.conf

to prevent any tool or configuration from modifying it.

For diagnosing the issue, look for entries similar to the following in your /var/log/messages:

Oct 14 12:40:52 hostname NET[22961]: /etc/sysconfig/network-scripts/ifdown-post : updated /etc/resolv.conf
Oct 14 12:40:57 hostname NET[23256]: /etc/sysconfig/network-scripts/ifup-post : updated /etc/resolv.conf

DNSChanger Check

Check to see if your computer is a victim of "DNS Changer" by visiting one of the following sites:

URL	Language
http://www.dns-ok.us/	English
http://www.dns-ok.de/	German
http://www.dns-ok.fi/	Finish
http://www.dns-ok.ax/	Swedish
http://www.dns-ok.fr/	French
http://www.dns-ok.ca/	English/French
http://www.dns-ok.lu/	English
http://dns-ok.nl/	Dutch/English

Source: https://forms.fbi.gov/check-to-see-if-your-computer-is-using-rogue-DNS

More about DNSChanger on the FBI site:
http://www.fbi.gov/news/stories/2011/november/malware_110911

http://www.fbi.gov/news/stories/2011/november/malware_110911/DNS-changer-malware.pdf

Public DNS

Google's Public DNS


The Google Public DNS IP addresses (IPv4) are as follows:
8.8.8.8
8.8.4.4

The Google Public DNS IPv6 addresses are as follows:
2001:4860:4860::8888
2001:4860:4860::8844

You can use either number as your primary or secondary DNS server. You can specify both numbers, but do not specify one number as both primary and secondary.
You can configure Google Public DNS addresses for either IPv4 or IPv6 connections, or both.


Open DNS Service

The IPV4 addresses are:


208.67.222.222
208.67.220.220