1
Diagnostic step 1
Confirm the root by running 'resolvectl status' before and after activating the VPN and compare the 'Domains' field for the VPN link. If domain is missing, this confirms per-link domain is not being set.
FULL AI ANALYSIS
systemd-resolved ignores per-connection DNS split-horizon rules after NetworkManager upgrade on Ubuntu 22.04
Generated Oct 3, 2026, 12:35:03 AM
Analysis summary
Evidence suggests the NetworkManager upgrade altered the way it communicates per-connection DNS domains to systemd-resolved (likely a DBus API change or a deliberate behavior change), resulting in systemd-resolved not associating a domain with the VPN link. Because direct queries to the VPN DNS server succeed, the DNS server itself is correct; the issue is the per-link domain assignment. Workarounds include configuring systemd-resolved with per-link settings using resolvectl or nm dispatcher scripts, or temporarily pinning NetworkManager to the previous version until an upstream fix is available.
Possible causes
NetworkManager upgrade changed DBus method or payload used to pass 'Domains' to systemd-resolved, leaving domain unset on the link.
95%A regression in NetworkManager's parsing of VPN connection 'domain' or 'search' fields for certain VPN types.
35%systemd-resolved updated expectations for per-link domain fields that are stricter and NetworkManager didn't adapt to.
15%Local /etc/systemd/resolved.conf or per-link override files conflict with newly written per-connection settings, preventing domain registration.
5%Suggested fixes
2
Diagnostic step 2
As a reversible workaround, add a NetworkManager dispatcher script (in /etc/NetworkManager/dispatcher.d/) that runs on connection-up to call 'resolvectl domain <ifindex> internal.example.corp' for the VPN link; test behavior and remove when no longer needed.
3
Diagnostic step 3
Open a bug report with NetworkManager including 'resolvectl status' output, NM connection profile, and verbose NM logs (sudo NM_CONTROLLED=1 dbus-send or journalctl -u NetworkManager) to help maintainers reproduce; if acceptable to your environment, temporarily pin NetworkManager to the previous package version while an upstream fix is pending.
4
Diagnostic step 4
If per-host overrides are acceptable temporarily, add DNS entries for critical hosts to /etc/hosts (note: this is manual and not scalable) or configure your applications to query the VPN DNS server directly.
5
Diagnostic step 5
If enterprise-managed, escalate to your distro or corporate networking team with the collected logs and reproduction steps so they can coordinate a rollback or patch; do not modify systemd-resolved internals unless instructed by maintainers.