How to configure systemd-resolved and systemd-networkd to use local DNS server for resolving local domains and remote DNS server for remote domains?

In the configuration file for local network interface (a file matching the name pattern /etc/systemd/network/*.network) we have to either specify we want to obtain local DNS server address from DHCP server using DHCP= option:

[Network]
DHCP=yes

or specify its address explicitly using DNS= option:

[Network]
DNS=10.0.0.1

In addition we need to specify (in the same section) local domains using Domains= option

Domains=domainA.example domainB.example ~example

We specify local domains domainA.example domainB.example to get the following behavior (from systemd-resolved.service, systemd-resolved man page):

Lookups for a hostname ending in one of the per-interface domains are exclusively routed to the matching interfaces.

This way hostX.domainA.example will be resolved exclusively by our local DNS server.

We specify with ~example that all domains ending in example are to be treated as route-only domains to get the following behavior (from description of this commit) :

DNS servers which have route-only domains should only be used for the specified domains.

This way hostY.on.the.internet will be resolved exclusively by our global, remote DNS server.

Note

Ideally, when using DHCP protocol, local domain names should be obtained from DHCP server instead of being specified explicitly in configuration file of network interface above. See UseDomains= option. However there are still outstanding issues with this feature – see systemd-networkd DHCP search domains option issue.

We need to specify remote DNS server as our global, system-wide DNS server. We can do this in /etc/systemd/resolved.conf file:

[Resolve]
DNS=8.8.8.8 8.8.4.4 2001:4860:4860::8888 2001:4860:4860::8844

Don't forget to reload configuration and to restart services:

$ sudo systemctl daemon-reload
$ sudo systemctl restart systemd-networkd
$ sudo systemctl restart systemd-resolved

Caution!

Above guarantees apply only when names are being resolved by systemd-resolved – see man page for nss-resolve, libnss_resolve.so.2 and man page for systemd-resolved.service, systemd-resolved.

See also:

• Description of routing lookup requests in systemd related man pages is unclear
• How to troubleshoot DNS with systemd-resolved?

References:

• Man page for systemd-resolved.service, systemd-resolved
• Man page for resolved.conf, resolved.conf.d
• Man page for systemd-network

Just to expand on @piotrDobrogost 's excellent answer, don't forget to config /etc/nsswitch.conf to use systemd-resolved as a DNS resolution source. Your hosts directive should look as follows for your particular use case:

/etc/nsswitch.conf

hosts:  files resolve dns

So if you limit the resolution to only those domains specified in the Domains directive in /etc/systemd/resolved.conf as Piotr details above, DNS should next be consulted in the order of name resolution sources specified /etc/nsswitch.conf when domains are NOT found in Domains directive:

The following link references the requirement to specify resolve in /etc/nsswitch.conf so systemd-resolved is consulted during name resolution:

https://github.com/systemd/systemd/issues/940

SystemD documentation I've found to be dire. I had to piece together an understanding from multiple links, including Piotr's answer above ;-)