When "Network Is Down" but the Server Is Fine: Debugging DNS Resolution Failures
You ping the server. It answers. You open the app in a browser. Connection refused — or worse, it hangs for thirty seconds and then times out. The server is up, the cable is plugged in, yet nothing resolves. Nine times out of ten, the problem is not the network at all. It is DNS. I have spent more than a few late nights on this exact symptom. Here is the field-tested path I now follow every time,…
When a network fails but the server operates normally, the issue often lies within DNS resolution. To diagnose this problem, start with basic tests using nslookup or dig commands. If there is no output or a SERVFAIL error, the resolver is at fault. If an IP address resolves correctly but the application still fails, investigate the app or firewall settings. If a domain name cannot be found (NXDOMAIN), the name itself is incorrect or the record has been removed.
On Linux systems, the resolver settings can sometimes be problematic. The file /etc/resolv.conf might have been overwritten by cloud-init, DHCP leases, or VPN clients, which can lead to lookup failures even if raw IP addresses work. If the file shows incorrect nameserver entries, switching to a reliable DNS provider can resolve the issue.
Internal DNS resolvers sometimes cause problems. If the resolver is flaky or caching incorrect information, it may lead to intermittent failures. Clearing the resolver cache with commands like sudo systemd-resolve --flush-caches can often solve the problem.
Firewalls can also block DNS queries. UDP port 53 (and TCP port 53 for larger responses) need to be open for outbound DNS requests. If a firewall rule only allows TCP but not UDP, it may cause some lookups to work while others fail. Checking the firewall settings with commands like nc -vzu 8.8.8.8 53 can help identify this issue.
To prevent DNS issues from causing service outages, it is recommended to pin a known-good DNS resolver in the server configuration. Using a stable pair of DNS servers, such as 8.8.8.8 and 1.1.1.1, and ensuring that the resolver uses these servers for all domains can prevent many DNS-related problems. Restarting the resolver service and ensuring the correct configuration is in place can help maintain stable DNS resolution.
Proactively monitoring DNS latency and setting up alerts can also help catch potential issues before they cause service disruptions.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.