Driver FixRecommendedSound, Wi-Fi or graphics acting up? Check drivers firstFind missing or outdated drivers fast.Check DriversHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsSlow PC?RecommendedPC slow today? Run a repair scan before it gets worseResolve common Windows issues and optimize system performance.Scan Now×
Skip to content
World desk9 min

How to Fix “Temporary Failure in Name Resolution” on a Linux VPS

A practical, resolver-owner-first guide to fixing “temporary failure in name resolution” on Ubuntu, Debian, and other Linux VPS images.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

“Temporary failure in name resolution” means your VPS cannot turn a hostname such as example.com into an IP address. First separate DNS from general networking: run ping -c 3 1.1.1.1, then test the normal resolver path with getent hosts example.com, query a known DNS server directly with dig @1.1.1.1 example.com +short, and inspect /etc/resolv.conf. The correct permanent fix depends on which service owns that file—usually systemd-resolved, NetworkManager, netplan, ifupdown/resolvconf, cloud-init, or your VPS provider’s DHCP configuration.

What the error actually means

Linux applications normally ask the system’s libc/NSS resolver stack to resolve a hostname. That stack reads the configured resolver information, commonly through /etc/resolv.conf, and sends DNS queries to one or more nameservers. If no usable answer comes back, programs such as ping, curl, apt, and dnf can report temporary failure in name resolution.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The word “temporary” describes the resolver result; it does not mean the fault will clear without intervention. A VPS can have a perfectly good route to the internet while DNS is broken. Conversely, a DNS-looking error can be a symptom of a failed interface, missing default route, blocked port 53, or a provider-side outage. Do not start by overwriting /etc/resolv.conf until you know which case you have.

Run these tests in order

Use a hostname that should exist, such as example.com. Run the commands as the affected user; add sudo only where shown.

  1. Check connectivity without DNS

    ping -c 3 1.1.1.1

    If this fails, DNS is not yet the primary problem. Inspect the interface and route with ip addr and ip route. Check that the VPS interface is up, that a default route exists, and that local or provider firewalls permit outbound traffic. A nameserver change cannot repair a broken network path.

  2. Test the resolver path used by ordinary programs

    getent hosts example.com

    getent exercises the same libc/NSS path used by most command-line applications. An address in the output means the normal resolver stack can answer. No output, or an error, means the configured resolver path is failing even if raw IP connectivity works.

    Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  3. Bypass local configuration and query a known DNS server

    dig @1.1.1.1 example.com +short

    If this returns an address while getent fails, routing to DNS works and the local configuration or resolver service is the likely fault. If this direct query also fails, investigate routing, firewall rules, blocked UDP/TCP port 53, the VPS provider’s policy, or an upstream DNS problem.

  4. Inspect the resolver file and its owner

    cat /etc/resolv.conf
    ls -l /etc/resolv.conf

    Record every nameserver line and whether the path is a regular file or a symbolic link. A file containing no nameserver, an unreachable address, or a broken symlink explains the failure. A line such as nameserver 127.0.0.53 usually means applications are meant to use the local systemd-resolved stub, not an external server directly.

Interpret the test results before changing anything

What you observe Most likely area Next action
ping -c 3 1.1.1.1 fails Interface, route, firewall, or provider networking Review ip addr, ip route, interface state, VPS security rules, and provider status before editing DNS.
Raw IP ping works; getent hosts example.com fails Local resolver configuration or service Inspect /etc/resolv.conf, identify its owner, and repair that owner’s configuration.
Direct dig @1.1.1.1 ... works; getent fails Broken local stub, stale file, or wrong nameserver Fix systemd-resolved, NetworkManager, netplan, ifupdown/resolvconf, or the managed DHCP settings.
Direct dig @1.1.1.1 ... also fails Port 53 filtering, route failure, provider restriction, or upstream DNS Test firewall and provider networking; use the provider’s internal resolver if it requires one.
/etc/resolv.conf is a broken symlink Resolver package or service was removed, disabled, or left with a stale link Restore the symlink expected by the active resolver, or configure the authoritative network service to recreate it.

Find which service owns DNS

The visible contents of /etc/resolv.conf are not necessarily the source of truth. A network service may regenerate the file at boot, when a lease renews, or whenever an interface reconnects. Use the clues below rather than making a change that will immediately be overwritten.

Owner or layer Useful clues Where to make the durable change
systemd-resolved nameserver 127.0.0.53; resolvectl status shows links and DNS servers The resolved or network configuration that supplies upstream DNS, followed by a resolver restart or cache flush when appropriate
NetworkManager NetworkManager manages the active connection and generates /etc/resolv.conf The active connection profile, normally with nmcli, then reconnect the profile
netplan Ubuntu systems with YAML files in /etc/netplan/ The relevant netplan YAML, then netplan try or netplan apply
ifupdown or resolvconf Debian-style interface definitions or a resolvconf-managed file The interface configuration or resolvconf input, followed by the tool’s update operation
cloud-init or provider DHCP Nameservers arrive with the lease or are defined in cloud-init/provider metadata Cloud-init or the VPS provider’s network/DHCP settings, not an isolated manual edit

Fix a VPS using systemd-resolved

A 127.0.0.53 entry is a local stub listener. It is valid only when systemd-resolved is running and has reachable upstream DNS servers. Check its view of every link and upstream server:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

resolvectl status

Look for the active interface, its DNS servers, DNS reachability, and whether a link has accidentally been assigned an empty or invalid configuration. Correct the upstream DNS in the network layer that feeds resolved—for example, the DHCP, netplan, NetworkManager, or provider configuration identified earlier. Do not replace the stub address with a random value merely because it is local.

After correcting that configuration, restart the service if it was stopped or wedged:

sudo systemctl restart systemd-resolved

If the service is healthy but old negative answers are cached, flush its cache:

sudo resolvectl flush-caches

Re-run resolvectl status and getent hosts example.com. If /etc/resolv.conf points to a resolved-generated file, keep that arrangement so the stub and the file remain consistent. If the symlink targets a path that no longer exists, restore the symlink expected by the distribution’s resolved setup rather than creating an unrelated permanent file.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Fix a VPS using NetworkManager

NetworkManager may rewrite /etc/resolv.conf every time a connection is activated. Identify the active profile and device:

nmcli connection show --active
nmcli device status

Set DNS on the active connection profile, replacing YOUR_CONNECTION with the exact profile name:

sudo nmcli connection modify "YOUR_CONNECTION" ipv4.dns "1.1.1.1" ipv4.ignore-auto-dns yes

The exact nameserver should be the one your VPS provider permits. Some providers expect an internal resolver and may block or rate-limit external DNS, so use their documented address when required. If you want DHCP-provided DNS instead, remove the manual override rather than leaving a stale server in the profile.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Reconnect the profile so NetworkManager regenerates the file:

sudo nmcli connection down "YOUR_CONNECTION"
sudo nmcli connection up "YOUR_CONNECTION"

For a remote production VPS, schedule this carefully: taking down the active connection can interrupt your SSH session. Use the provider console or an out-of-band terminal if a disconnect would strand you. Confirm the regenerated /etc/resolv.conf, then test with getent and the application that originally failed.

Fix netplan, ifupdown, resolvconf, or provider-managed networking

Ubuntu netplan

When netplan is authoritative, edit the YAML file in /etc/netplan/ that defines the active interface. A typical nameserver block is placed under that interface’s nameservers key; preserve the file’s existing indentation and interface settings. Apply cautiously:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  1. sudo netplan try applies the candidate configuration with a rollback opportunity if connectivity is lost.
  2. If the result is correct, confirm it and then use sudo netplan apply when your operating procedure requires a final apply.
  3. Check resolvectl status and cat /etc/resolv.conf after the interface reconnects.

Do not edit a generated resolver file while leaving netplan configured with different values; the next apply or reboot will replace your edit.

Debian ifupdown or resolvconf

On systems using ifupdown, nameservers may be specified in the interface definition or supplied through resolvconf. Put the values in the layer that brings the interface up, then run that system’s supported update/reload operation. The exact file and command vary with the installed packages, so first inspect the active interface configuration and whether /etc/resolv.conf is a resolvconf symlink. A hand edit to a generated file is only a temporary diagnostic.

cloud-init and VPS DHCP

Cloud images can receive DNS settings from cloud-init metadata or the provider’s DHCP lease. If the file is correct immediately after boot but changes after a lease renewal or reboot, change the cloud-init or provider network setting. Some VPS platforms expose an internal resolver that is reachable only from their network; replacing it with a public resolver can fail even though the VPS itself has internet access. Ask the provider which resolver addresses and firewall rules apply to the plan and region.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Use a manual edit only as a controlled emergency test

First determine whether /etc/resolv.conf is a regular file. If ls -l shows a symlink, editing the target without understanding its owner can affect a generated runtime file or fail because the target is missing. If it is a regular, unmanaged file and you need a short-lived test, back it up and write a known reachable nameserver:

sudo cp -a /etc/resolv.conf /etc/resolv.conf.backup
printf 'nameserver 1.1.1.1
' | sudo tee /etc/resolv.conf

Immediately test with getent hosts example.com. If resolution returns, the previous resolver content was the problem; now move the setting into the service that owns networking. Do not treat this as a permanent fix on a managed VPS. Broadcom Support notes: “Manual edits to /etc/resolv.conf are lost immediately after a reboot or a restart of the systemd-networkd service.” Restore the backup or let the authoritative service regenerate the file after testing.

Check firewalls, port 53, and provider restrictions

DNS normally uses UDP port 53 and can fall back to TCP port 53 for large responses or when UDP is unavailable. A VPS firewall, host firewall, security group, or provider egress policy can block one or both. If raw IP connectivity works but a direct query fails, inspect the rules that govern outbound traffic and any provider-level network ACLs.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Compare UDP and TCP behavior:

dig @1.1.1.1 example.com +short
dig @1.1.1.1 example.com +tcp +short

A UDP-only failure suggests filtering, MTU or fragmentation trouble, or a path-specific issue; a failure over both transports points more broadly to routing, policy, or the selected upstream server. Do not open inbound DNS service on the VPS merely to fix outbound lookups. A client needs permitted outbound queries; it does not need to run a public DNS server.

VPN clients, container runtimes, and security agents can also replace resolver settings or install network namespaces with different DNS views. Stop or reconfigure the component temporarily, reconnect the interface, and check whether the owning service regenerates /etc/resolv.conf. If only containers fail, inspect the container runtime’s DNS configuration separately from the host.

Verify the repair and its persistence

Resolution is fixed only when both the ordinary resolver path and the failing application work. Run the following after the change:

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  1. getent hosts example.com confirms libc/NSS resolution.
  2. dig example.com confirms the resolver selected by the local configuration.
  3. Repeat the command that failed, such as curl https://example.com or sudo apt update.
  4. Reconnect the interface, renew its lease, or reboot during a maintenance window if that is how the VPS normally regenerates network configuration.
  5. Run the same three checks again and inspect resolvectl status or cat /etc/resolv.conf to ensure the nameserver did not revert.

If a reboot breaks resolution again, the durable configuration is still being supplied by a different layer. Revisit the ownership table and change the profile, YAML, cloud-init metadata, or provider DHCP setting rather than repeatedly patching the generated file.

When to escalate to the VPS provider

Open a provider ticket or use the provider console when ping -c 3 1.1.1.1 fails despite a valid interface and default route, when direct DNS queries fail over both UDP and TCP while other outbound traffic is permitted, or when the provider requires an internal resolver whose address is unavailable. Include the VPS region, interface and route output, the nameserver entries, whether /etc/resolv.conf is a symlink, the output of resolvectl status if present, and the exact direct dig result. This lets support distinguish a guest configuration error from a host-network or upstream DNS fault without asking you to expose credentials.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.