Lando lndo.site DNS resolution failure on Virgin Media

Problem

*.lndo.site sites wouldn't resolve. Lando publishes a real public wildcard DNS record for *.lndo.site pointing at 127.0.0.1, so this normally needs no local setup at all.

Queries timed out rather than returning NXDOMAIN, and did so against every resolver — including 1.1.1.1 and 8.8.8.8 directly.

Diagnosis

The give-away was that only loopback-valued answers failed:

Same server, same zone — only responses containing 127.0.0.1 vanished. That is the Virgin Media Hub's DNS rebind protection, implemented as a silent packet drop rather than a rewrite. Hence the timeout instead of an error.

Confirming with DNS-over-HTTPS, which the Hub can't inspect:

curl -s 'https://cloudflare-dns.com/dns-query?name=test.lndo.site&type=A' \
  -H 'accept: application/dns-json'
# -> "data": "127.0.0.1"

Note that switching upstream resolver does not help — the interference is on the local path, so it's the encryption that matters, not the server.

Solution

Encrypted DNS via systemd-resolved. One drop-in file, no extra daemon:

sudo mkdir -p /etc/systemd/resolved.conf.d
sudo tee /etc/systemd/resolved.conf.d/90-dot.conf >/dev/null <<'EOF'
[Resolve]
DNS=1.1.1.1#cloudflare-dns.com 1.0.0.1#cloudflare-dns.com
FallbackDNS=9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net
DNSOverTLS=yes
Domains=~.
EOF
sudo systemctl restart systemd-resolved

Domains=~. is essential — without it the DHCP-supplied Virgin resolvers still win for most queries. Ubuntu doesn't ship resolved.conf.d, hence the mkdir -p.

Verify:

resolvectl query test.lndo.site   # -> 127.0.0.1, "encrypted transport: yes"
resolvectl status | grep -E 'DNSOverTLS|Current DNS'

Per-link entries still listing 194.168.4.100 are harmless; Domains=~. means they go unused.

Caveats

• DNSOverTLS=yes is strict: on a network blocking port 853 (some hotel/corporate wifi) DNS fails outright rather than falling back to droppable plaintext.
• Still requires internet, since *.lndo.site is an internet-hosted record.

Offline / network-independent alternative

Answer the zone locally with dnsmasq, but scope it through resolved rather than replacing the system resolver — this avoids the usual port-53 conflicts:

# /etc/dnsmasq.d/lando.conf
listen-address=127.0.0.54
bind-interfaces
no-resolv
address=/lndo.site/127.0.0.1

# /etc/systemd/resolved.conf.d/lando.conf
[Resolve]
DNS=127.0.0.54
Domains=~lndo.site

~lndo.site is routing-only, so just that zone goes to dnsmasq and everything else keeps using DoT. The query never leaves the machine, so the Hub is bypassed entirely and it works offline.

For a handful of sites, plain /etc/hosts entries also work (no wildcards) — lando info lists the hostnames.