diff --git a/inventory/group_vars/all b/inventory/group_vars/all
index 0cb253773e..877a1ea56b 100644
--- a/inventory/group_vars/all
+++ b/inventory/group_vars/all
@@ -265,3 +265,6 @@ nagios_Check_Services:
 # Set variable if we want to use our global iptables defaults
 # Some things need to set their own.
 baseiptables: True
+
+# Most of our machines have manual resolv.conf files
+nm_controlled_resolv: False
diff --git a/roles/base/tasks/main.yml b/roles/base/tasks/main.yml
index b398126e04..ba82a66142 100644
--- a/roles/base/tasks/main.yml
+++ b/roles/base/tasks/main.yml
@@ -24,6 +24,7 @@
 # XXX fixme # a datacenter 'fact' from setup
 - name: /etc/resolv.conf
   copy: src={{ item }} dest=/etc/resolv.conf
+  when: not nm_controlled_resolv
   with_first_found:
   - "{{ resolvconf }}"
   - resolv.conf/{{ inventory_hostname }}
@@ -53,7 +54,7 @@
   ini_file: dest=/etc/NetworkManager/NetworkManager.conf section=main option=dns value=none
   notify:
   - restart NetworkManager
-  when: ansible_distribution_major_version|int >=7 and nmclitest|success and ( not ansible_ifcfg_blacklist)
+  when: ansible_distribution_major_version|int >=7 and nmclitest|success and ( not ansible_ifcfg_blacklist) and not nm_controlled_resolv
   tags:
    - config
    - resolvconf
@@ -124,6 +125,7 @@
 
 - name: make sure our resolv.conf is the one being used - set RESOLV_MODS=no in /etc/sysconfig/network
   lineinfile: dest=/etc/sysconfig/network create=yes backup=yes state=present line='RESOLV_MODS=no' regexp=^RESOLV_MODS=
+  when: not nm_controlled_resolv
   tags:
   - config
   - base
diff --git a/roles/base/templates/ifcfg.j2 b/roles/base/templates/ifcfg.j2
index 1a1ae4b70f..55f7ac83a8 100644
--- a/roles/base/templates/ifcfg.j2
+++ b/roles/base/templates/ifcfg.j2
@@ -29,3 +29,4 @@ IPV6_DEFAULTDEV={{item}}
 IPV6_DEFAULTGW={{ hostvars[inventory_hostname][item + '_ipv6_gw'] }}
 IPV6_MTU=1280
 {% endif %}
+DOMAIN="phx2.fedoraproject.org vpn.fedoraproject.org fedoraproject.org"