diff --git a/2023/misc/vpn-dns.md b/2023/misc/vpn-dns.md
new file mode 100644
index 0000000..be0b80a
--- /dev/null
+++ b/2023/misc/vpn-dns.md
@@ -0,0 +1,26 @@
+# routing DNS for a specific domain through a specific DNS server
+
+suppose you have a VPN link, and additionally some private DNS server accessible through the VPN that resolves hosts on the VPN. you want to have DNS queries for VPN hosts, which are subdomains of a common domain, to go to the special VPN DNS server, but all other queries to use the normal system DNS
+
+turns out this is 🦐 quite shrimple 🦐 with `systemd-resolved`, which your system is probably running already<sup id="fnref:1" role="doc-noteref"><a href="#fn:1" rel="footnote">1</a></sup>
+
+assuming the VPN link is `tun0`:
+
+```
+resolvectl dns tun0 <vpn dns server>
+resolvectl domain tun0 "~vpn.local.domain"
+```
+
+the `~` in front of the domain makes it a "routing-only" domain instead of a search domain. this means that instead of adding it to unqualified domains during DNS queries, it's used as a filter to direct all queries under the domain only to the DNS server configured for that interface
+
+(you can also do this non-imperatively in NetworkManager or `systemd-networkd`)
+
+```
+<EOF>
+```
+
+---
+
+<ol>
+<li id="fn:1" role="doc-endnote">unless you're into linux pervert shit, in which case i assume you know what you're doing <a href="#fnref:1" role="doc-backlink">↩</a></li>
+</ol>