DNS

Every device in your TxNet gets a name you can use instead of an IP address. On top of that, admins can publish their own names (like printer.acme.internal), send lookups for internal domains to your own nameservers, and choose which nameservers devices use for everything else. You set all of this once in the dashboard, and TxHub pushes it to every connected device within seconds.

How it works#

When a device is connected, the TxHub app runs a small DNS resolver on the device at 100.100.100.100. The operating system sends lookups to it, and it decides what to do with each name:

• Names in your TxNet (device names and your own records) are answered on the device itself, from the configuration TxHub sent it. Nothing leaves the device.
• Names covered by a split DNS rule go to the nameservers you set for that domain.
• Everything else goes to the global nameservers.

Only admins and owners can view or change DNS settings. Everything on this page is under Settings → DNS Configuration in the dashboard.

Device names#

Each TxNet has a DNS domain, normally <name>.tx.net, for example acme.tx.net. Every device is published under it with its machine name, so a laptop called laptop can be reached as laptop.acme.tx.net. Because the TxNet domain is also a search domain on every device, the short name works too:

$ ping laptop
$ ping laptop.acme.tx.net

• A device's name starts out as its hostname. Renaming a machine in the dashboard changes its name. See Devices.
• A machine's details page shows its Short domain and Full domain.
• Devices shared into your TxNet from another TxNet appear under shared, for example nas.shared.acme.tx.net, so you can tell them apart from your own.

Changing the TxNet domain

The DNS domain is set when your TxNet is created. Admins and owners can't change it themselves. Only TxHub can, so contact TxHub support if you need a different <name>.tx.net or a domain you own.

Your own zones and records#

The DNS zones card lists the domains your devices resolve through the TxNet. Changes here apply immediately and are pushed to every device. You don't need to press Save.

• The Primary zone is your TxNet's DNS domain. It always publishes every device under its machine name. You can add records to it, such as printer.acme.tx.net, but it can't be deleted or reconfigured.
• Additional zones are domains of your own, such as acme.internal. Use them for names that should only exist inside your TxNet.

Add a zone

1. Go to Settings → DNS Configuration and click Add zone. The Add DNS zone dialog opens.
2. Enter the Zone name, for example acme.internal. The name can't be changed later.
3. Turn on Publish machine names if every device should also be reachable as <machine>.acme.internal.
4. Turn on Use as search domain if people should be able to type a short name and have devices try this zone.
5. Click Add zone.

A few names are not allowed, so they can't clash with real internet domains or with TxHub itself:

• Single-word zones are limited to internal, lan, corp, intranet and private.
• Zones under local, localhost, onion, invalid or arpa are not allowed (home.arpa is fine), and neither is anything under tx.net or txhub.is.
• A zone can't overlap your TxNet's DNS domain or an application's domain, and can't have the same name as a split DNS domain.

Add a record

1. In the zone, click Add record.
2. Enter the Name relative to the zone, for example printer. In an additional zone, use @ for the zone name itself.
3. Choose the Type and fill in the value. The dialog shows the full name under Resolves as.
4. Click Add record.

• To spread load across several addresses, add the same name again with another address (up to 8 addresses per name).
• In the primary zone, a record can't use a name that a device already has.
• A TxNet can have up to 20 additional zones and 1,000 records. Up to 3 additional zones can publish machine names. The card shows how many you have used.

Split DNS#

Split DNS sends lookups for one domain to nameservers you choose. Use it when you already run DNS for an internal domain, for example an Active Directory domain or corp.example.com on your office network. Lookups for that domain and its subdomains go to your nameservers. Everything else is unaffected.

1. Go to Settings → DNS Configuration and find the Split DNS card.
2. Enter the Domain, for example internal.corp.
3. Enter the Nameservers (comma-separated), for example 10.0.0.1, 10.0.0.2, and click +.
4. Click Save at the top of the page.

Global nameservers#

Global Nameservers answer every name that isn't in your TxNet or covered by split DNS: websites, cloud services and so on. If you leave the list empty, devices use 1.1.1.1 and 8.8.8.8. If you add your own, they replace those defaults. Macs are the exception: they keep using their own DNS settings for these names (see below).

1. In the Global Nameservers card, enter an address such as 9.9.9.9 and press Enter or click +.
2. Add more if you want a backup.
3. Click Save at the top of the page.

Global nameservers are still used while a device uses an exit node.

Search domains#

Search Domains let people type a short name. With corp.example.com as a search domain, typing wiki also tries wiki.corp.example.com. Your TxNet's DNS domain is always a search domain, and zones with Use as search domain turned on are added too. Add others in the Search Domains card and click Save.

Use DNS settings on a device#

Each device decides whether to use the DNS settings from your TxNet. It is on by default, and you normally want to keep it on: without it, device names and your own records won't resolve on that device. You might turn it off on a server that must keep its own DNS setup, or when another VPN on the same computer manages DNS.

There is no switch for this in the TxHub app. Use the command line:

You can also pass --accept-dns=false to txhub up when you first connect a device.

How each operating system applies it

• Windows (Windows 10 and 11): TxHub sets its resolver as the DNS server on the TxHub network adapter and adds a catch-all rule to the Windows Name Resolution Policy Table (NRPT). All lookups then go through TxHub and on to your global nameservers, instead of leaking to the DNS servers of other network adapters.
• macOS: TxHub writes a file under /etc/resolver for your TxNet's domain, each of your zones and each split DNS domain, pointing them at the TxHub resolver. Other names keep using the Mac's own DNS settings.
• Linux: TxHub works with whatever manages DNS on the system: systemd-resolved, NetworkManager, resolvconf, or /etc/resolv.conf directly. Lookups go through the TxHub resolver and on to your global nameservers.

Check your DNS setup#

On the device, show the DNS configuration it received and what the operating system is using:

$ txhub dns status

The first section should say TXHub DNS: enabled. Below it you'll find the resolvers, split DNS routes, search domains and any extra records your TxNet sent. Add --all for more detail.

To ask the TxHub resolver about one name and see which resolver answered it:

$ txhub dns query laptop.acme.tx.net
$ txhub dns query printer.acme.internal
# Ask for another record type as a second argument
$ txhub dns query server.acme.internal AAAA

Troubleshooting#

A name doesn't resolve

1. Run txhub status and check that the device is connected.
2. Run txhub dns status. If it says TXHub DNS: disabled., turn DNS settings back on (see Use DNS settings on a device).
3. Run txhub dns query <name>. If TxHub answers but your browser or app doesn't, the operating system has cached an old answer. Flush the cache (below).
4. For split DNS names, check that the device can reach your nameservers, for example with ping 10.0.0.1.

Flush the DNS cache

After changing records, operating systems can keep an old answer for a short while. To clear it:

$ ipconfig /flushdns

$ sudo dscacheutil -flushcache
$ sudo killall -HUP mDNSResponder

$ resolvectl flush-caches

Restarting the browser also helps, since browsers keep their own DNS cache.

Two VPNs on one computer

If another VPN client also manages DNS, the two can overwrite each other's settings. On Linux this happens when DNS is managed through /etc/resolv.conf or resolvconf. Turn off DNS settings in one of them with --accept-dns=false, or use systemd-resolved, where both can work side by side.

Still stuck? See Troubleshooting.