Comment 0 for bug 1592721

Currently, NM will write all search domains to both any DNS-handling plugins running, and also to resolv.conf / resolvconf; in all cases.

The issue is that doing so means that in the split-DNS case on VPNs, you might get a negative response from all nameservers, then a new request by glibc with the search tacked on, to nameservers again, which might cause DNS requests for "private" resources (say, on the VPN) to be sent to external, untrusted resolvers, or for DNS queries not meant for VPN nameservers to be sent through the VPN anyway.

This is fixable in the case where we have a caching plugin running (such as dnsmasq). dnsmasq will already know about the search domains and use that to limit queries to the right nameservers when a VPN is running. Writing search domains to resolv.conf is unnecessary in this case.

We should still write search domains if no caching gets done, as we then need to expect glibc to send requests as it otherwise would.