Networking · 2 steps

DNS is not resolving

Separate the resolver from the record, and find out which of the several DNS paths on a modern machine is actually being used.

Every step

Find out who is answering

A modern Linux box may have systemd-resolved, an /etc/hosts entry, an NSS module and a container resolver all in play. Testing with dig alone can give a different answer than the application gets, and then you debug the wrong thing.

$ cat /etc/resolv.conf

$ resolvectl status 2>/dev/null | head -30

$ getent hosts <name> # the path the application actually takes

$ dig +short <name> # straight to the DNS server, bypassing NSS

Look for: Whether getent and dig agree. If they disagree, the answer is not coming from DNS at all.

Read the response code

NXDOMAIN and SERVFAIL are entirely different failures. One says the name does not exist, the other says the server could not answer — and only one of them is your problem to fix.

$ dig <name>

$ dig <name> @8.8.8.8 # compare against a public resolver

$ dig +trace <name> # walk it from the root

Look for: The `status:` field in the header. NOERROR with an empty answer section is its own case — the name exists but has no record of that type.