Debian 9 – DNS resolution fails with systemd-resolved misconfiguration

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Hostname lookups fail and package, API, and service dependencies break.

Environment & Reproduction

Occurs after DNS stack changes, resolver symlink drift, or network manager conflicts.

# Capture baseline
cat /etc/resolv.conf
ls -l /etc/resolv.conf
getent hosts deb.debian.org
systemctl status systemd-resolved --no-pager || true

Root Cause Analysis

Resolver configuration and active DNS service ownership are inconsistent, causing lookup failures.

Quick Triage

Check effective nameserver path and test direct resolver reachability.

# Quick triage
resolvectl status 2>/dev/null || true
dig @8.8.8.8 deb.debian.org +short
ping -c 2 8.8.8.8

Step-by-Step Diagnosis

Correlate resolver state, logs, and symlink ownership for root cause confirmation.

# Detailed diagnosis
journalctl -u systemd-resolved -n 200 --no-pager || true
cat /etc/nsswitch.conf
strace -e trace=network getent hosts deb.debian.org 2>&1 | tail -n 80

Solution – Primary Fix

Standardize resolver ownership and apply known-good nameserver settings.

# Primary fix
sudo systemctl enable --now systemd-resolved || true
sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
sudo systemctl restart systemd-resolved || true

Solution – Alternative Approaches

Use static resolver configuration when resolved is not part of target baseline.

# Alternatives
echo -e 'nameserver 1.1.1.1nnameserver 8.8.8.8' | sudo tee /etc/resolv.conf

Verification & Acceptance Criteria

Forward and reverse DNS lookups succeed and package operations recover.

# Verify
getent hosts deb.debian.org
dig deb.debian.org +short
apt-get update

Rollback Plan

Restore prior resolv.conf and disable resolved if compatibility issues emerge.

# Rollback
sudo cp /etc/resolv.conf.bak /etc/resolv.conf 2>/dev/null || true
sudo systemctl disable --now systemd-resolved || true

Prevention & Hardening

Document resolver ownership and monitor DNS failure rate as an SLO indicator.

# Hardening
cat /etc/resolv.conf
grep hosts /etc/nsswitch.conf

Related Errors & Cross-Refs

Related to temporary failure resolving, name or service not known, and timeout errors.

Related tutorial: View the step-by-step tutorial for Debian 9.

View all Debian 9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

systemd-resolved, nsswitch, and Debian DNS troubleshooting references.