Fix "Temporary failure in name resolution" on Linux

When apt update, curl or ping google.com fail with Temporary failure in name resolution (or Could not resolve host), the server cannot turn names into IP addresses. The network may be fine; DNS resolution is what is broken. Here is how to fix it.

Before you start

• Root access, ideally through the provider console in case you change network settings.

Separate DNS from network problems

ping -c 3 1.1.1.1

• Ping by IP fails: it is a network/routing problem, not DNS. Check ip addr, ip route and your provider.
• Ping by IP works, names fail: DNS. Continue below.

Test a public resolver directly:

dig @1.1.1.1 example.com +short

If that works but plain dig example.com does not, the server's configured resolver is the problem.

Check resolv.conf

cat /etc/resolv.conf

• On Ubuntu it usually points to nameserver 127.0.0.53, the local systemd-resolved stub. That is normal.
• On other systems it should list real nameservers, e.g. your provider's or 1.1.1.1 / 8.8.8.8.
• An empty file, a broken symlink or unreachable nameservers cause the error.

Fix systemd-resolved (Ubuntu)

resolvectl status

It shows which DNS servers each interface uses. If none are listed, set them in netplan (e.g. /etc/netplan/50-cloud-init.yaml):

nameservers:
  addresses: [1.1.1.1, 8.8.8.8]

Apply with netplan apply. Or set global fallbacks in /etc/systemd/resolved.conf:

[Resolve]
DNS=1.1.1.1 9.9.9.9

Then systemctl restart systemd-resolved. Make sure /etc/resolv.conf is a symlink to /run/systemd/resolve/stub-resolv.conf and that the service is running.

Fix it on AlmaLinux and Rocky

NetworkManager manages DNS there. Set servers on the connection:

nmcli con mod eth0 ipv4.dns "1.1.1.1 8.8.8.8" && nmcli con up eth0

Use your actual connection name from nmcli con show. Editing /etc/resolv.conf by hand works until NetworkManager rewrites it.

Check the firewall

DNS uses UDP (and TCP) port 53 outbound. Overly strict output rules block it:

• UFW: default outgoing should be allow.
• CSF: port 53 must be in UDP_OUT and TCP_OUT.
• Test: dig @1.1.1.1 example.com +tcp as well as UDP.

Other causes

• Local DNS server down: if you run your own resolver (bind, unbound, dnsmasq) and point to 127.0.0.1, check that service.
• /etc/hosts errors: a broken hosts file can affect lookups of specific names.
• Docker containers only: containers copy the host's resolver; a 127.0.0.53 stub is not reachable inside containers, so Docker falls back to defaults or set "dns" in /etc/docker/daemon.json.
• Provider network issue: if the provider's resolvers are down, switch to public resolvers temporarily.

Check the fix

getent hosts example.com

getent uses the same resolution path as applications. Then retry apt update.

Name resolution FAQ

Why does it say "temporary"?

The resolver library reports failures that might succeed later (no answer from the DNS server) as temporary, even if they persist.

Which public DNS servers can I use?

Cloudflare 1.1.1.1, Google 8.8.8.8 and Quad9 9.9.9.9 are common, reliable choices.

Does this affect my website's visitors?

No, this is the server's own outgoing DNS. It does break outgoing features: updates, APIs, email delivery and plugin updates.

Next steps

• The dig command explained
• Static IP with netplan
• Network troubleshooting tools