diff --git a/nixos/modules/config/networking.nix b/nixos/modules/config/networking.nix
index 293a42d38b5..d4b1e6d6b96 100644
--- a/nixos/modules/config/networking.nix
+++ b/nixos/modules/config/networking.nix
@@ -39,6 +39,17 @@ in
'';
};
+ networking.dnsExtensionMechanism = lib.mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Enable the edns0
option in resolv.conf. With
+ that option set, glibc
supports use of the extension mechanisms for
+ DNS (EDNS) specified in RFC 2671. The most popular user of that feature is DNSSEC,
+ which does not work without it.
+ '';
+ };
+
networking.extraResolvconfConf = lib.mkOption {
type = types.lines;
default = "";
@@ -162,7 +173,10 @@ in
libc_restart='${pkgs.systemd}/bin/systemctl try-restart --no-block nscd.service 2> /dev/null'
'' + optionalString cfg.dnsSingleRequest ''
# only send one DNS request at a time
- resolv_conf_options='single-request'
+ resolv_conf_options+=' single-request'
+ '' + optionalString dnsExtensionMechanism ''
+ # enable extension mechanisms for DNS
+ resolv_conf_options+=' edns0'
'' + optionalString hasLocalResolver ''
# This hosts runs a full-blown DNS resolver.
name_servers='127.0.0.1'