DNS Resolution Error: 6 Causes and the Right Fix

Q: How do I test DNS resolution?

`dig example.com` or `nslookup example.com`. The team that uses these has reliable DNS diagnostics.

DNS resolution error means the resolver (system, application, or upstream) couldn’t translate a hostname to an IP. Common causes per Cloudflare’s DNS troubleshooting guide: bad resolver config, upstream DNS server down, stale cache, /etc/hosts override, captive portal intercept, DNSSEC validation failure. The team that walks through this checklist resolves the issue in minutes.

Diagnose with dig or nslookup
Cause 1: bad resolver config
Cause 2: upstream DNS down
Cause 3: stale cache
Cause 4: /etc/hosts override
Cause 5: captive portal
Cause 6: DNSSEC validation failure
Captive portal / corporate firewall
Performance: slow DNS
FAQ

Diagnose with dig or nslookup

dig example.com
# or
nslookup example.com

If this fails, DNS resolution is broken at the system level. If it works but the app fails, the app has its own resolver config.

Cause 1: bad resolver config

Check /etc/resolv.conf:

nameserver 1.1.1.1
nameserver 8.8.8.8

The team that has 127.0.0.53 (systemd-resolved) needs to check the systemd-resolved config, not just resolv.conf.

Cause 2: upstream DNS down

Test multiple resolvers:

dig @1.1.1.1 example.com
dig @8.8.8.8 example.com

If one resolver works but another doesn’t, the failing resolver is the issue. The team that has multiple resolvers in resolv.conf has fallback.

Cause 3: stale cache

DNS caches at multiple layers:

# System cache (systemd-resolved)
systemd-resolve --flush-caches

# Application cache (browser, etc.) - clear browser cache

The team that has TTL-based caching has stale entries during the TTL window.

Cause 4: /etc/hosts override

cat /etc/hosts

Check for static entries overriding DNS. The team that has stale entries in /etc/hosts is overriding DNS unintentionally.

Cause 5: captive portal

Public WiFi often requires accepting terms before DNS works. The team that sees DNS work on mobile but not on the laptop’s WiFi has captive portal interception. Fix: open browser, accept terms.

Cause 6: DNSSEC validation failure

DNSSEC validates signatures. If the chain breaks:

dig +dnssec example.com

The team that has DNSSEC enabled and a misconfigured trust anchor has failures. Fix: rotate the trust anchor or disable DNSSEC for that resolver.

Captive portal / corporate firewall

Some networks block external DNS (port 53) and require using internal DNS. The team that sees DNS work at home but fail at the office has the corporate DNS policy. Fix: use the office’s DNS server.

Performance: slow DNS

Slow DNS adds latency to every connection. The team that has slow DNS:

Tests with time dig example.com - should be sub-100ms.
Switches to faster resolver (1.1.1.1, 8.8.8.8).
Enables DNS caching (systemd-resolved, dnsmasq, nscd).
Uses DNS-over-HTTPS (DoH) if network supports it.

FAQ

How do I test DNS resolution?

dig example.com or nslookup example.com. The team that uses these has reliable DNS diagnostics.

Why does DNS work for some sites but not others?

Either cached entries with different TTLs, or specific upstream resolvers returning NXDOMAIN. The team that traces the specific failing domain has a path to fix.

Should I use 1.1.1.1 or 8.8.8.8?

Both are fast and reliable. 1.1.1.1 (Cloudflare) and 8.8.8.8 (Google) have similar performance globally. The team that picks one and sticks with it has consistent DNS.

What’s the difference between DNS resolver and DNS server?

Resolver: client-side, does recursive lookups. Server: authoritative, returns answers. The team that uses ‘resolver’ for system-level, ‘server’ for authoritative is correct.

Can I use DNS-over-TLS or DNS-over-HTTPS?

Yes - systemd-resolved supports DoT and DoH. The team that uses encrypted DNS avoids ISP-level DNS hijacking (common on captive portals).

If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.

Useful related references: