Scope: Debian-based and RHEL-based Linux distributions
Topics: Resolution order, /etc/nsswitch.conf, /etc/hosts, /etc/resolv.conf, dig, nslookup, host, getent, systemd-resolved, NetworkManager DNS, caching, and search domains.

1. Inspect the Resolution Order#

Inspect the Name Service Switch configuration:

cat /etc/nsswitch.conf

Locate the hosts line:

hosts: files dns

files resolves names through /etc/hosts. dns queries the nameservers in /etc/resolv.conf. Sources are consulted from left to right.

2. Add Local Host Mappings#

Edit the local hosts file:

sudo vim /etc/hosts

Format:

127.0.0.1   localhost
192.0.2.10  db01.example.internal db01
192.0.2.20  app01.example.internal app01

Each line starts with an IP address, followed by the canonical name and optional aliases.

Verify the mapping:

getent hosts db01

Expected output:

192.0.2.10      db01.example.internal db01

3. Inspect /etc/resolv.conf#

Show the active resolver configuration:

cat /etc/resolv.conf

Expected output:

nameserver 192.0.2.53
nameserver 8.8.8.8
search example.internal

On most current systems this file is generated automatically. It is a symlink to a runtime file managed by systemd-resolved or NetworkManager. Do not edit it directly: the next network event overwrites the change.

4. Query DNS Directly#

Resolve a name with dig:

dig example.com
dig +short example.com

Query one specific nameserver:

dig @<NAMESERVER> example.com

Use nslookup or host for quick checks:

nslookup example.com
host example.com

Resolve through the full system path, including /etc/hosts:

getent hosts example.com

Options:

• +short: Prints only the answer records.
• @<NAMESERVER>: Sends the query to one server and bypasses /etc/resolv.conf.
• getent hosts: Uses the same lookup path as applications. If getent works but dig fails, /etc/hosts provides the answer.

Part 1: Debian-Based Systems#

Examples: Debian, Ubuntu

1. Inspect the Resolver Status#

Ubuntu and current Debian releases commonly use systemd-resolved:

resolvectl status

The output lists the DNS servers, search domains, and DNSSEC mode for each link.

2. Inspect Resolver Statistics#

Show cache and query statistics:

resolvectl statistics

Check the effective configuration for one interface:

resolvectl status <INTERFACE>

3. Flush the Cache#

Clear the local DNS cache after changing records:

sudo resolvectl flush-caches

Verify with a direct query:

dig +short example.com

4. Override DNS Servers at Runtime#

Set DNS servers for one link temporarily:

sudo resolvectl dns <INTERFACE> <NAMESERVER>

Persist the change in the netplan configuration:

network:
  version: 2
  ethernets:
    <INTERFACE>:
      dhcp4: true
      nameservers:
        addresses:
          - 192.0.2.53
          - 8.8.8.8
        search:
          - example.internal

Apply with sudo netplan apply. Runtime overrides are lost at reboot or when the link is renegotiated.

Part 2: RHEL-Based Systems#

Examples: RHEL, Rocky Linux, AlmaLinux

1. Inspect the DNS Configuration#

NetworkManager applies DNS settings from connection profiles:

nmcli device show <INTERFACE> | grep DNS

Expected output:

IP4.DNS[1]:                             192.0.2.53
IP4.DNS[2]:                             8.8.8.8

Inspect the profile values:

nmcli connection show <CONNECTION> | grep -i dns

2. Set DNS Servers#

Modify the connection profile:

sudo nmcli connection modify <CONNECTION> ipv4.dns "192.0.2.53 8.8.8.8"
sudo nmcli connection up <CONNECTION>

Ignore DNS servers received over DHCP:

sudo nmcli connection modify <CONNECTION> ipv4.ignore-auto-dns yes
sudo nmcli connection up <CONNECTION>

Add a search domain:

sudo nmcli connection modify <CONNECTION> ipv4.dns-search example.internal

Options:

• ipv4.dns: Sets the DNS servers as a space-separated list.
• ipv4.ignore-auto-dns yes: Discards DNS servers provided by DHCP.
• ipv4.dns-search: Sets the search domains for short names.

3. Understand /etc/resolv.conf Handling#

NetworkManager rewrites /etc/resolv.conf through its DNS plugin. Verify the file after every change:

ls -l /etc/resolv.conf
cat /etc/resolv.conf

RHEL 9 can optionally use systemd-resolved. Identify the active manager before making changes:

systemctl is-active NetworkManager
systemctl is-active systemd-resolved

Edits to /etc/resolv.conf do not survive a reconnect while a manager is active.

Part 3: Important Notes#

Resolution Flow#

Troubleshooting Flow#

Command Reference#

Security Guidelines#

• Do not edit /etc/resolv.conf directly on systems where systemd-resolved or NetworkManager manages it. Configure DNS through netplan or nmcli instead.
• Prefer internal resolvers for internal names. Do not send internal hostnames to public DNS services.
• Use search domains to keep short names working instead of growing /etc/hosts.
• Keep /etc/hosts small. Large local files are hard to audit and drift between machines.
• Verify both the direct query (dig) and the system path (getent hosts) before concluding that DNS is broken.
• Flush the cache after changing DNS records and confirm the new answer with dig +short.
• Do not raise resolver timeouts or disable validation to mask intermittent failures. Fix the resolver instead.
• Use trusted or encrypted DNS infrastructure for production systems.
• Replace placeholders such as <NAME>, <NAMESERVER>, and <CONNECTION> with actual values. Do not include the angle brackets in commands.