Zscaler DNS on Linux (systemd-resolved)

#!/bin/bash
# Self-healing DNS guard for Zscaler + systemd-resolved.
#
# Model: Zscaler's DNS interference should exist ONLY while the tray app is open.
#   * App OPEN  (ZSTray running) -> ensure zsaservice is running; if the tunnel
#                                   is up, make sure zcctun0 has DNS + "~.".
#   * App QUIT  (ZSTray gone)    -> stop zsaservice so it can't hijack DNS, then
#                                   restore the uplink to its normal (DHCP /
#                                   NetworkManager) resolver + default route.
set -uo pipefail

TUN="zcctun0"
ZSCALER_DNS="100.64.0.2"
PROBE="gateway.zscaler.net"
INTERVAL=2

app_running() {
  pgrep -f '/opt/zscaler/bin/ZSTray' &>/dev/null
}

tunnel_up() {
  ip link show "$TUN" &>/dev/null || return 1
  timeout 2 dig @"$ZSCALER_DNS" +time=1 +tries=1 +short "$PROBE" &>/dev/null
}

tun_dns_applied() {
  resolvectl status "$TUN" 2>/dev/null | grep -q "DNS Servers: $ZSCALER_DNS"
}

apply_tun() {
  resolvectl dns "$TUN" "$ZSCALER_DNS"
  resolvectl domain "$TUN" '~.'
  resolvectl flush-caches
}

default_iface() {
  ip route show default 2>/dev/null | awk -v tun="$TUN" '$5!=tun {print $5; exit}'
}

# Healthy = real DNS servers, no "~." catch-all, default route enabled.
iface_healthy() {
  local st
  st="$(resolvectl status "$1" 2>/dev/null)"
  echo "$st" | grep -q "DNS Servers:" || return 1
  echo "$st" | grep -q "DNS Domain: ~\." && return 1
  echo "$st" | grep -q "Default Route: no" && return 1
  return 0
}

# Restore the uplink to the resolver NetworkManager knows (DHCP-provided, so it
# also covers local/home zones), re-enable it as a default DNS route, and drop
# any "~." leftover. Prefer NM's DNS over the gateway — the gateway may not serve
# your local zones.
restore_physical_dns() {
  local def_if nm_dns
  def_if="$(default_iface)"
  [ -n "${def_if:-}" ] || return 0
  iface_healthy "$def_if" && return 0

  nm_dns="$(nmcli -g IP4.DNS dev show "$def_if" 2>/dev/null | tr '\n|' '  ')"
  resolvectl revert "$def_if" 2>/dev/null || true
  resolvectl default-route "$def_if" yes 2>/dev/null || true
  [ -n "${nm_dns// /}" ] && resolvectl dns "$def_if" $nm_dns
  resolvectl flush-caches
}

# Debounce: only treat the app as "quit" after it's been gone for several
# consecutive checks, so a brief ZSTray restart/relaunch doesn't churn zsaservice.
MISS_LIMIT=3
misses=0

while true; do
  if app_running; then
    misses=0
    systemctl is-active --quiet zsaservice || systemctl start --no-block zsaservice
    if tunnel_up; then
      tun_dns_applied || apply_tun
    fi
  else
    misses=$((misses + 1))
    if [ "$misses" -ge "$MISS_LIMIT" ]; then
      systemctl is-active --quiet zsaservice && systemctl stop zsaservice
      ip link show "$TUN" &>/dev/null && resolvectl revert "$TUN" 2>/dev/null || true
      restore_physical_dns
    fi
  fi
  sleep "$INTERVAL"
done

[Unit]
Description=Zscaler DNS self-healing guard
After=network.target zsaservice.service
Wants=network.target

[Service]
Type=simple
ExecStart=/opt/zscaler/scripts/zscaler-dns-guard.sh
Restart=always
RestartSec=3

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now zscaler-dns-guard.service

sudo rm -f /etc/systemd/system/zsaservice.service.d/resolve-dns.conf
sudo rmdir /etc/systemd/system/zsaservice.service.d 2>/dev/null || true
sudo systemctl daemon-reload

[Resolve]
FallbackDNS=1.1.1.1 9.9.9.9
DNSSEC=no

sudo systemctl restart systemd-resolved