Ubuntu 26.04 LTS – systemd-resolved returns SERVFAIL for internal DNS zones

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Administrators observe: Ubuntu 26.04 LTS – systemd-resolved returns SERVFAIL for internal DNS zones. Service discovery and API integrations fail intermittently.

Environment & Reproduction

Issue appears with split DNS, VPN routing changes, or stale resolver links.

# Baseline context
lsb_release -a
resolvectl status
cat /etc/resolv.conf
ip r
sudo journalctl -u systemd-resolved -n 100 --no-pager

Root Cause Analysis

Incorrect per-link DNS routing domains or fallback resolver usage can cause internal zones to resolve via the wrong upstream servers.

Quick Triage

Test queries against resolved and direct upstream servers.

# Quick triage
resolvectl query internal.example.local || true
dig +short internal.example.local @127.0.0.53
dig +short internal.example.local @
resolvectl dns

Step-by-Step Diagnosis

Inspect routing domains and interface-level DNS assignments.

# Detailed diagnosis
resolvectl domain
resolvectl dns
networkctl status --no-pager || true
sudo journalctl -b -u systemd-resolved --no-pager | tail -n 200

Solution – Primary Fix

Set correct DNS servers and routing domains per interface, then restart resolver.

# Primary fix
sudo resolvectl dns  
sudo resolvectl domain  '~example.local'
sudo systemctl restart systemd-resolved
resolvectl flush-caches
resolvectl query internal.example.local

Solution – Alternative Approaches

Configure DNS directly in netplan and disable conflicting resolver clients.

# Alternative
sudoedit /etc/netplan/01-netcfg.yaml
# Add nameservers and search domains
sudo netplan apply
sudo systemctl restart systemd-resolved

Verification & Acceptance Criteria

Internal and external DNS resolve correctly from the expected upstreams.

# Verify
resolvectl query internal.example.local
resolvectl query ubuntu.com
dig +short internal.example.local @127.0.0.53
getent hosts internal.example.local

Rollback Plan

Revert per-link DNS/domain settings and restore previous netplan resolver configuration.

# Rollback
sudo resolvectl revert 
sudo cp -a /etc/netplan /etc/netplan.rollback.$(date +%F)
sudo netplan apply

Prevention & Hardening

Standardize split DNS profiles for VPN and datacenter interfaces.

# Hardening
resolvectl statistics
sudo systemctl enable systemd-resolved
sudo journalctl -u systemd-resolved --since '24 hours ago' --no-pager | grep -i fail || true

Related Errors & Cross-Refs

Related patterns include temporary failure in name resolution, stale /etc/resolv.conf symlink, and DNS leaks to public resolvers.

Related tutorial: View the step-by-step tutorial for Ubuntu 26.04 LTS.

View all Ubuntu 26.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

systemd-resolved manual, Ubuntu DNS troubleshooting guide, and netplan DNS configuration reference.