LFCA 45 🐧 Resolving Names — /etc/hosts and /etc/resolv.conf
The previous chapter explained what the DNS does. This chapter covers the two files that decide where the resolver looks and in what order: /etc/hosts and /etc/resolv.conf. The two are the local configuration of the name resolution, and they are the first place to look when a name does not resolve. The /etc/hosts is the static, the local override, and it is consulted before the DNS. The /etc/resolv.conf declares the DNS servers the resolver asks, and it is the file the DHCP and the systemd-resolved write. The /etc/nsswitch.conf declares the order — the hosts line says whether the files or the DNS is the first — and it is the file that ties the two together. This chapter covers the three files, the format, the resolution order, the systemd-resolved‘s handling, the common failures, and the diagnostic tools — the getent, the dig, the resolvectl, and the host. It is the practical companion to LFCA 44 and prepares the ground for the DNS server configuration.
Key point: The /etc/hosts maps the hostnames to the IP addresses, and it is the static and the local. The /etc/resolv.conf declares the DNS servers, and it is the dynamic (the DHCP or the systemd-resolved writes it). The /etc/nsswitch.conf‘s hosts line declares the order — the typical is files dns, which means the /etc/hosts is consulted first, and the DNS is the fallback. The systemd-resolved is the modern resolver, and it handles the /etc/resolv.conf as a symlink to the stub-resolv.conf. The getent hosts <name> shows the system’s resolution, the dig shows the DNS’s, and the resolvectl shows the systemd-resolved‘s. The 127.0.0.1 and the localhost are the loopback, and the 127.0.1.1 is the Debian’s hostname entry.
Why the two files exist
The name resolution has the two sources: the local files and the DNS. The two are the different, and the two are the complementary.
The /etc/hosts‘ case. The static mapping is the local, and it is the override. The localhost is the loopback, and the 127.0.0.1 is the address. The /etc/hosts is the way to declare the name that does not need the DNS.
The /etc/resolv.conf‘s case. The DNS servers are the remote, and they are the dynamic. The DHCP assigns the servers, and the systemd-resolved manages the file. The /etc/resolv.conf is the way to declare the servers, and the file is the resolver’s configuration.
Why the local first. The /etc/hosts is the local, and the lookup is the fast. The file is the small, and the read is the instant. The local first is the performance, and the override is the use.
Why the DNS second. The DNS is the remote, and the lookup is the slower. The DNS is the large, and the read is the query. The DNS second is the fallback, and the fallback is the completeness.
Why the order matters. The order determines the answer when the two disagree. The /etc/hosts‘s entry wins if the file is first, and the DNS’s entry wins if the DNS is first. The order is the policy, and the nsswitch.conf is the declaration.
Why the local override is the useful. The local override is the way to block a domain (the 0.0.0.0), to test a server (the new address), to declare a name (the local). The override is the control, and the control is the use.
Why the static is the documentation. The /etc/hosts is the small, and the entries are the few. The file is the documentation, and the documentation is the reference. The static is the explicit, and the explicit is the clarity.
Why the two files are the first to check. The name resolution’s failure is the common, and the two files are the first. The
/etc/hosts‘s typo, the/etc/resolv.conf‘s wrong server, thensswitch.conf‘s wrong order — the three are the cause. The three are the first, and the first is the diagnosis.
The /etc/hosts file
The /etc/hosts is the static mapping, and each line has the IP address and the hostnames. The file is the local, and the resolution is the first (in the typical order).
# /etc/hosts
127.0.0.1 localhost
127.0.1.1 myhost
192.168.1.100 server1 server1.example.com
192.168.1.50 printer printer.local
10.0.0.5 db01 db01.internalEach line has the address and one or more names. The 127.0.0.1 localhost is the loopback, and the 192.168.1.100 server1 server1.example.com is the server’s two names.
The format. The line has the IP, the whitespace, the canonical name, and the aliases. The first name is the canonical, and the rest are the aliases.
<IP> <canonical> <alias1> <alias2>The 192.168.1.100 server1 server1.example.com has the server1 as the canonical and the server1.example.com as the alias.
Why the canonical and the aliases. The canonical is the primary name, and the aliases are the additional. The resolution returns the address for any of them, and the canonical is the return.
The loopback. The 127.0.0.1 localhost is the loopback, and the ::1 localhost is the IPv6. The two are the standard, and the file has the both.
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopbackThe 127.0.0.1 is the IPv4, and the ::1 is the IPv6. The localhost is the name, and the resolution returns the 127.0.0.1 (the IPv4) or the ::1 (the IPv6).
Why the loopback is the standard. The localhost is the loopback’s name, and the resolution returns the loopback’s address. The traffic does not leave the device, and the pattern is the local.
The Debian’s 127.0.1.1. The Debian and the Ubuntu add the 127.0.1.1 <hostname> to the /etc/hosts, and the hostname is the machine’s name. The line makes the hostname resolve to the 127.0.1.1, which is the loopback’s secondary.
127.0.1.1 myhostThe myhost is the hostname, and the 127.0.1.1 is the loopback’s secondary. The Debian’s convention is the reason, and the convention is the 127.0.1.1.
Why the 127.0.1.1 matters. The 127.0.1.1 is the Debian’s, and the hostname resolves to it. The line is the convention, and the convention is the avoidance of the DHCP’s hostname. The 127.0.1.1 is the local, and the local is the safe.
The 0.0.0.0 for the block. The 0.0.0.0 ads.example.com blocks the domain, and the resolution returns the 0.0.0.0, which is the invalid. The pattern is the block, and the use is the ad-blocking.
0.0.0.0 ads.example.com
0.0.0.0 tracker.example.comThe 0.0.0.0 is the block, and the domain is the blocked. The pattern is the local, and the use is the ad-blocking.
Why the 0.0.0.0 is the block. The 0.0.0.0 is the “any” address, and the connection to the 0.0.0.0 fails. The block is the effective, and the use is the ad-blocking. The pattern is the simple, and the simple is the effective.
The format’s rules. The IP is the first, the names are the rest, the # is the comment, the blank lines are ignored. The file is the plain text, and the edit is the simple.
Why the file is the static. The file does not change unless the administrator edits it. The static is the predictable, and the predictable is the control. The file is the source, and the source is the manual.
Why the file’s order matters. The resolution returns the first match, and the file’s order is the priority. The 127.0.0.1 localhost is the first, and the match is the first. The order is the priority, and the priority is the file’s.
The /etc/resolv.conf file
The /etc/resolv.conf declares the DNS servers the resolver asks, and the search domains. The file is the dynamic (the DHCP or the systemd-resolved writes it).
# /etc/resolv.conf
nameserver 192.168.1.1
nameserver 8.8.8.8
nameserver 8.8.4.4
search example.com
options timeout:2 attempts:3The nameserver is the DNS server, and the search is the domain’s suffix, and the options are the resolver’s tuning.
The nameserver. The nameserver is the DNS server’s address, and the file has the up to three (the traditional limit).
nameserver 192.168.1.1
nameserver 8.8.8.8
nameserver 8.8.4.4The first is the primary, and the rest are the fallback. The resolver tries the first, and if the first does not respond, it tries the next.
Why the three’s limit. The traditional limit is the three, and the modern is the more. The resolver’s behavior is the first then the next, and the order is the priority. The limit is the legacy, and the modern is the more.
The search. The search is the domain’s suffix, and the resolver appends it to the short name.
search example.comThe ping server1 becomes the ping server1.example.com, and the resolver tries the server1.example.com. The search is the convenience, and the convenience is the short name.
Why the search matters. The search is the domain’s, and the short name works. The server1 is the short, and the server1.example.com is the full. The search is the domain’s, and the domain is the suffix.
The domain (the legacy). The domain is the search‘s legacy, and the single domain. The modern is the search, and the legacy is the domain.
domain example.comThe options. The options is the resolver’s tuning, and the timeout, the attempts, the ndots, the rotate are the common.
options timeout:2 attempts:3The timeout:2 is the two seconds, and the attempts:3 is the three tries. The ndots:1 is the dot’s threshold, and the rotate is the round-robin.
Why the timeout matters. The timeout is the resolver’s wait, and the short is the fast but the flaky. The timeout:2 is the two seconds, and the default is the five. The tuning is the balance, and the balance is the design.
Why the ndots matters. The ndots is the dot’s threshold, and the resolver tries the search first if the name has fewer dots. The ndots:1 is the one dot, and the default is the one. The pattern is the search’s, and the search is the suffix.
The systemd-resolved‘s handling. The systemd-resolved is the modern resolver, and it handles the /etc/resolv.conf as the symlink to the stub-resolv.conf.
ls -l /etc/resolv.conf
# /etc/resolv.conf -> ../run/systemd/resolve/stub-resolv.confThe stub-resolv.conf has the nameserver 127.0.0.53, which is the systemd-resolved‘s stub, and the systemd-resolved forwards the queries to the real servers.
Why the stub matters. The stub is the 127.0.0.53, and the systemd-resolved is the forwarder. The file is the symlink, and the resolvectl status is the real. The stub is the modern, and the modern is the systemd-resolved.
Why the file can be the overwritten. The DHCP’s client writes the /etc/resolv.conf, and the systemd-resolved writes the stub-resolv.conf. The manual edit is the overwritten, and the persistent is the resolved.conf or the DHCP’s configuration. The overwrite is the common, and the common is the surprise.
Why the file should not be edited manually. The file is the generated, and the manual edit is the lost. The resolved.conf or the DHCP’s configuration is the source, and the source is the persistent. The file is the generated, and the generated is the read-only.
The /etc/nsswitch.conf file
The /etc/nsswitch.conf declares the order of the name resolution, and the hosts line is the name’s. The file is the policy, and the policy is the order.
# /etc/nsswitch.conf
hosts: files dnsThe hosts: files dns means the /etc/hosts is the first, and the DNS is the second. The order is the policy, and the policy is the file’s.
The files. The files is the /etc/hosts, and the lookup is the file. The local is the first, and the first is the priority.
The dns. The dns is the DNS, and the lookup is the query. The remote is the second, and the second is the fallback.
The mdns. The mdns is the multicast DNS, and the lookup is the local network’s. The .local is the mDNS’s, and the pattern is the local.
The myhostname. The myhostname is the systemd’s, and the lookup is the machine’s hostname. The pattern is the modern, and the use is the hostname’s.
The resolve. The resolve is the systemd-resolved‘s, and the lookup is the resolved. The pattern is the modern, and the use is the systemd-resolved.
hosts: files mdns4_minimal [NOTFOUND=return] dns myhostnameThe files is the first, the mdns4_minimal is the second, the [NOTFOUND=return] is the condition, the dns is the third, and the myhostname is the fourth.
Why the order matters. The order determines the answer when the two disagree. The files dns means the /etc/hosts wins, and the dns files means the DNS wins. The order is the policy, and the policy is the file’s.
Why the [NOTFOUND=return] matters. The [NOTFOUND=return] means the resolution stops if the mdns4_minimal returns the not found. The pattern is the conditional, and the conditional is the control.
Why the file should be checked. The file’s order is the resolution’s, and the file is the first to check. The getent hosts uses the nsswitch’s order, and the dig bypasses it. The two are the different, and the difference is the diagnosis.
Why the getent matters. The getent hosts <name> shows the system’s resolution, which uses the nsswitch’s order. The dig shows the DNS’s, which bypasses the order. The two together are the diagnosis.
Why the file is the system’s. The /etc/nsswitch.conf is the system’s, and the order is the system’s. The file is the policy, and the policy is the system’s. The file is the reference, and the reference is the system’s.
Why the three files are the resolution’s configuration. The
/etc/hostsis the local, the/etc/resolv.confis the DNS’s, and the/etc/nsswitch.confis the order. The three are the configuration, and the configuration is the resolution. The three are the first, and the first is the diagnosis.
The resolution’s order
The resolution’s order is the nsswitch’s, and the typical is files dns. The order is the priority, and the priority is the answer.
The step 1: the /etc/hosts. The resolver reads the /etc/hosts, and the match is the answer. The local is the first, and the first is the priority.
The step 2: the DNS. The resolver queries the DNS, and the answer is the response. The remote is the second, and the second is the fallback.
The step 3: the cache. The systemd-resolved caches the answer, and the subsequent queries are the fast. The cache is the performance, and the TTL is the limit.
Why the order is the files dns. The local first is the performance, and the DNS second is the completeness. The two are the standard, and the standard is the files dns.
Why the order can be the dns files. The DNS first is the centralized, and the local second is the override. The two are the alternative, and the alternative is the specific.
Why the order can be the files mdns4_minimal [NOTFOUND=return] dns. The mdns is the local network’s, and the [NOTFOUND=return] is the conditional. The pattern is the modern, and the modern is the mDNS’s.
Why the order should be the documented. The order is the policy, and the policy is the documented. The /etc/nsswitch.conf is the source, and the source is the file. The order is the explicit, and the explicit is the clarity.
Why the order can be the confusing. The order is the nsswitch’s, and the tools are the different. The getent uses the order, and the dig bypasses it. The two are the different, and the difference is the diagnosis. The ping uses the order, and the dig does not. The two are the different, and the difference is the confusion.
The diagnostic tools
The diagnostics use the getent, the dig, the resolvectl, the host, and the cat. Each has the purpose, and the combination is the diagnosis.
The getent hosts. The getent hosts <name> shows the system’s resolution, which uses the nsswitch’s order.
getent hosts example.com
# 93.184.216.34 example.com
getent hosts localhost
# 127.0.0.1 localhostThe getent uses the order, and the result is the system’s. The localhost resolves to the 127.0.0.1 (the /etc/hosts), and the example.com resolves to the 93.184.216.34 (the DNS).
Why the getent is the system’s. The getent uses the nsswitch’s order, and the result is the system’s. The ping and the curl use the same, and the getent is the explicit.
The dig. The dig <name> queries the DNS, and the result is the DNS’s.
dig example.com
# example.com. 3600 IN A 93.184.216.34The dig bypasses the nsswitch, and the result is the DNS’s. The dig and the getent may differ if the /etc/hosts has the entry.
Why the dig is the DNS’s. The dig queries the DNS directly, and the result is the DNS’s. The dig bypasses the /etc/hosts, and the two are the different. The difference is the diagnosis.
The resolvectl. The resolvectl query <name> queries the systemd-resolved, and the resolvectl status shows the resolver’s configuration.
resolvectl query example.com
# example.com: 93.184.216.34
resolvectl status
# Link 2 (eth0)
# DNS Servers: 192.168.1.1The resolvectl query is the query, and the resolvectl status is the config. The systemd-resolved is the modern, and the resolvectl is the interface.
Why the resolvectl is the modern. The systemd-resolved is the modern resolver, and the resolvectl is the interface. The pattern is the systemd, and the systemd is the modern.
The host. The host <name> is the simple, and the result is the one-line.
host example.com
# example.com has address 93.184.216.34The host uses the resolver, and the result is the one-line. The host is the simple, and the simple is the quick.
The cat. The cat /etc/hosts and the cat /etc/resolv.conf show the files, and the files are the configuration.
cat /etc/hosts
cat /etc/resolv.conf
cat /etc/nsswitch.confThe three files are the configuration, and the cat is the read. The files are the first, and the first is the diagnosis.
Why the cat is the first. The files are the configuration, and the cat is the read. The /etc/hosts‘s typo, the /etc/resolv.conf‘s wrong server, the /etc/nsswitch.conf‘s wrong order — the three are the cause. The cat is the first, and the first is the diagnosis.
Why the tools are the layered. The getent is the system’s, the dig is the DNS’s, the resolvectl is the systemd-resolved‘s, and the cat is the files’. The layers are the diagnosis, and the combination is the complete.
Why the dig and the getent should be the pair. The dig bypasses the nsswitch, and the getent uses it. The two together isolate the failure. If the dig works and the getent fails, the nsswitch’s order or the /etc/hosts is the problem. If both fail, the DNS is the problem.
Complete Example Session
# ============================================
# PART 1: THE /etc/hosts
# ============================================
cat /etc/hosts
# 127.0.0.1 localhost
# 127.0.1.1 myhost
# 192.168.1.100 server1 server1.example.com
# 0.0.0.0 ads.example.com
# ============================================
# PART 2: THE /etc/resolv.conf
# ============================================
cat /etc/resolv.conf
# nameserver 192.168.1.1
# nameserver 8.8.8.8
# search example.com
# ============================================
# PART 3: THE /etc/nsswitch.conf
# ============================================
grep hosts /etc/nsswitch.conf
# hosts: files dns
# ============================================
# PART 4: THE SYSTEM'S RESOLUTION
# ============================================
getent hosts server1
# 192.168.1.100 server1 server1.example.com
getent hosts example.com
# 93.184.216.34 example.com
getent hosts localhost
# 127.0.0.1 localhost
# ============================================
# PART 5: THE DNS'S RESOLUTION
# ============================================
dig server1
# ;; ANSWER SECTION:
# server1.example.com. 3600 IN A 203.0.113.10
# The DNS's answer differs from the /etc/hosts.
# ============================================
# PART 6: THE SYSTEMD-RESOLVED
# ============================================
ls -l /etc/resolv.conf
# /etc/resolv.conf -> ../run/systemd/resolve/stub-resolv.conf
cat /etc/resolv.conf
# nameserver 127.0.0.53
resolvectl status
# Link 2 (eth0)
# DNS Servers: 192.168.1.1
# ============================================
# PART 7: THE BLOCK
# ============================================
# /etc/hosts
# 0.0.0.0 ads.example.com
getent hosts ads.example.com
# 0.0.0.0 ads.example.com
ping ads.example.com
# PING ads.example.com (0.0.0.0) ...
# The connection fails.
# ============================================
# PART 8: THE SEARCH
# ============================================
# /etc/resolv.conf
# search example.com
ping server1
# The resolver tries server1.example.com.
# The /etc/hosts has the server1.
# The /etc/hosts wins.
# ============================================
# PART 9: THE DIAGNOSIS
# ============================================
# 1. cat /etc/hosts
# 2. cat /etc/resolv.conf
# 3. grep hosts /etc/nsswitch.conf
# 4. getent hosts <name>
# 5. dig <name>
# 6. resolvectl query <name>
# ============================================
# PART 10: WHAT NOT TO DO
# ============================================
# Don't edit the /etc/resolv.conf manually
# The DHCP or the systemd-resolved overwrites it.
# Don't forget the nsswitch's order
# The files dns means the /etc/hosts first.
# Don't assume the dig and the getent are the same
# The dig bypasses the nsswitch.
# Don't use the 0.0.0.0 without the reason
# The block is the effective, but the reason is the documentation.
# Don't ignore the search
# The short name is the search's.
# Don't forget the /etc/hosts' order
# The first match wins.The ten parts cover the /etc/hosts, the /etc/resolv.conf, the /etc/nsswitch.conf, the system’s resolution, the DNS’s resolution, the systemd-resolved, the block, the search, the diagnosis, and the anti-patterns.
Quick Reference
The Three Files
| File | Purpose | The source |
|---|---|---|
/etc/hosts | The static mapping | The manual |
/etc/resolv.conf | The DNS servers | The DHCP, the systemd-resolved |
/etc/nsswitch.conf | The order | The system |
The /etc/hosts‘s Format
| Field | Purpose |
|---|---|
| The IP | The address |
| The canonical | The primary name |
| The aliases | The additional names |
The # | The comment |
The /etc/resolv.conf‘s Fields
| Field | Purpose |
|---|---|
nameserver | The DNS server |
search | The domain’s suffix |
domain | The legacy’s suffix |
options | The tuning |
The /etc/nsswitch.conf‘s Values
| Value | Purpose |
|---|---|
files | The /etc/hosts |
dns | The DNS |
mdns | The mDNS |
myhostname | The hostname |
resolve | The systemd-resolved |
The Tools
| Command | Purpose |
|---|---|
getent hosts <name> | The system’s resolution |
dig <name> | The DNS’s resolution |
resolvectl query <name> | The systemd-resolved’s |
resolvectl status | The resolver’s config |
host <name> | The simple |
cat /etc/hosts | The file |
The Common Entries
| Entry | Purpose |
|---|---|
127.0.0.1 localhost | The loopback |
::1 localhost | The IPv6 loopback |
127.0.1.1 myhost | The Debian’s hostname |
0.0.0.0 ads.example.com | The block |
192.168.1.100 server1 | The server’s |
Best Practices
✅ Do This:
# Check the /etc/hosts
cat /etc/hosts # ✅
# Check the /etc/resolv.conf
cat /etc/resolv.conf # ✅
# Check the /etc/nsswitch.conf
grep hosts /etc/nsswitch.conf # ✅
# Use the getent for the system's resolution
getent hosts example.com # ✅
# Use the dig for the DNS's resolution
dig example.com # ✅
# Use the resolvectl for the systemd-resolved
resolvectl query example.com # ✅
# Use the 0.0.0.0 for the block
0.0.0.0 ads.example.com # ✅
# Check the symlink
ls -l /etc/resolv.conf # ✅❌ Don’t Do This:
# Don't edit the /etc/resolv.conf manually
# The DHCP or the systemd-resolved overwrites it. # ⚠️
# Don't forget the nsswitch's order
# The files dns means the /etc/hosts first. # ⚠️
# Don't assume the dig and the getent are the same
# The dig bypasses the nsswitch. # ⚠️
# Don't use the 0.0.0.0 without the reason
# The block is the effective, but the reason is the documentation.│# ⚠️
# Don't ignore the search
# The short name is the search's. # ⚠️
# Don't forget the /etc/hosts' order
# The first match wins. # ⚠️Common Pitfalls
| Pitfall | Problem | Solution |
|---|---|---|
The /etc/resolv.conf‘s manual edit | The overwrite | The resolved.conf |
| The nsswitch’s order | The wrong answer | Check the order |
The dig vs the getent | The different | The two are the diagnosis |
The 0.0.0.0‘s block | The effective but the undocumented | The comment |
| The search | The short name | Check the search |
The /etc/hosts‘s typo | The wrong answer | Check the file |
| The duplicate entry | The first wins | Check the order |
The stub’s 127.0.0.53 | The systemd-resolved | The resolvectl |
Real-World Examples
1. The /etc/hosts
cat /etc/hosts2. The /etc/resolv.conf
cat /etc/resolv.conf3. The /etc/nsswitch.conf
grep hosts /etc/nsswitch.conf4. The getent
getent hosts example.com5. The dig
dig example.com6. The resolvectl
resolvectl query example.com7. The block
0.0.0.0 ads.example.com8. The search
search example.com9. The symlink
ls -l /etc/resolv.conf10. The diagnosis
getent hosts example.com && dig example.comVisual: The Resolution’s Order
┌──────────────────────────────────────────────────────────┐
│ THE APPLICATION (the ping, the curl) │
│ │ │
│ ▼ │
│ THE NSSWITCH'S ORDER (/etc/nsswitch.conf) │
│ hosts: files dns │
│ │ │
│ ├── THE FILES (/etc/hosts) │
│ │ The match? The answer. │
│ │ │
│ └── THE DNS (/etc/resolv.conf) │
│ The query. The answer. │
│ │
│ The order is the policy, and the policy is the file's. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The /etc/hosts
┌──────────────────────────────────────────────────────────┐
│ 127.0.0.1 localhost │
│ │ │ │
│ │ └── the canonical name │
│ └── the IP address │
│ │
│ 192.168.1.100 server1 server1.example.com │
│ │ │ │ │
│ │ │ └── the alias │
│ │ └── the canonical │
│ └── the IP │
│ │
│ 0.0.0.0 ads.example.com │
│ │ │ │
│ │ └── the blocked domain │
│ └── the block │
│ │
│ The first match wins. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The /etc/resolv.conf
┌──────────────────────────────────────────────────────────┐
│ nameserver 192.168.1.1 │
│ │ │ │
│ │ └── the DNS server │
│ └── the keyword │
│ │
│ nameserver 8.8.8.8 │
│ nameserver 8.8.4.4 │
│ The fallback servers. │
│ │
│ search example.com │
│ │ │ │
│ │ └── the domain's suffix │
│ └── the keyword │
│ │
│ THE SYSTEMD-RESOLVED'S STUB │
│ nameserver 127.0.0.53 │
│ The stub, the forwarder. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The nsswitch’s Order
┌──────────────────────────────────────────────────────────┐
│ hosts: files dns │
│ │ │ │
│ │ └── the DNS second │
│ └── the /etc/hosts first │
│ │
│ THE RESOLUTION │
│ 1. The /etc/hosts │
│ 2. The DNS │
│ │
│ hosts: files mdns4_minimal [NOTFOUND=return] dns myhostname│
│ │ │ │ │ │ │
│ │ │ │ │ └── the hostname│
│ │ │ │ └── the DNS │
│ │ │ └── the stop if the not found│
│ │ └── the mDNS │
│ └── the /etc/hosts │
│ │
│ The order is the policy. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The Diagnosis
┌──────────────────────────────────────────────────────────┐
│ 1. cat /etc/hosts │
│ The local's entries. │
│ │
│ 2. cat /etc/resolv.conf │
│ The DNS's servers. │
│ │
│ 3. grep hosts /etc/nsswitch.conf │
│ The order. │
│ │
│ 4. getent hosts <name> │
│ The system's resolution (the nsswitch's order). │
│ │
│ 5. dig <name> │
│ The DNS's resolution (the bypass). │
│ │
│ 6. resolvectl query <name> │
│ The systemd-resolved's. │
│ │
│ If the dig works and the getent fails, the /etc/hosts │
│ or the nsswitch's order is the problem. │
│ │
│ If both fail, the DNS is the problem. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The block
┌──────────────────────────────────────────────────────────┐
│ /etc/hosts │
│ │
│ 0.0.0.0 ads.example.com │
│ │ │ │
│ │ └── the domain │
│ └── the block │
│ │
│ ping ads.example.com │
│ PING ads.example.com (0.0.0.0) ... │
│ │
│ The connection to 0.0.0.0 fails. │
│ The domain is blocked. │
│ │
│ The pattern is the ad-blocking. │
│ The 0.0.0.0 is the invalid, and the invalid is the block.│
│ │
└──────────────────────────────────────────────────────────┘Summary
| File | Purpose | The source |
|---|---|---|
/etc/hosts | The static mapping | The manual |
/etc/resolv.conf | The DNS servers | The DHCP, the systemd-resolved |
/etc/nsswitch.conf | The order | The system |
| Item | Value |
|---|---|
| The default order | The files dns |
| The loopback | The 127.0.0.1 localhost |
| The Debian’s hostname | The 127.0.1.1 |
| The block | The 0.0.0.0 |
| The search | The domain’s suffix |
| The stub | The 127.0.0.53 |
| The system’s tool | The getent |
| The DNS’s tool | The dig |
| The modern’s tool | The resolvectl |
Key takeaways:
- The
/etc/hostsis the static mapping, and it is the local override — the file is the manual, and the first match wins - The
/etc/resolv.confdeclares the DNS servers, and it is the dynamic — the DHCP or thesystemd-resolvedwrites it, and the manual edit is the overwritten - The
/etc/nsswitch.conf‘shostsline declares the order — thefiles dnsis the typical, and the order determines the answer - The
127.0.0.1 localhostis the loopback, and the127.0.1.1is the Debian’s hostname — the two are the standard, and the standard is the convention - The
0.0.0.0is the block — the domain resolves to the invalid, and the connection fails - The
searchis the domain’s suffix — the short name works, and the resolver appends the suffix - The
systemd-resolvedis the modern resolver — the/etc/resolv.confis the symlink to thestub-resolv.conf, and theresolvectlis the interface - The
getentuses the nsswitch’s order, and thedigbypasses it — the two together isolate the failure - The
catof the three files is the first diagnosis — the/etc/hosts‘s typo, the/etc/resolv.conf‘s wrong server, and the/etc/nsswitch.conf‘s wrong order - The
getentand thedigare the pair — if thedigworks and thegetentfails, the/etc/hostsor the order is the problem, and if both fail, the DNS is the problem
Remember: The name resolution’s configuration is the three files: the /etc/hosts for the static, the /etc/resolv.conf for the DNS, and the /etc/nsswitch.conf for the order. The /etc/hosts is the local override, the /etc/resolv.conf is the DNS’s servers, and the /etc/nsswitch.conf is the priority. The getent shows the system’s, the dig shows the DNS’s, and the resolvectl shows the modern’s. The 0.0.0.0 is the block, the search is the suffix, and the 127.0.0.1 is the loopback. The three files are the first, and the first is the diagnosis.
Stop using slow, ad-bloated tool sites! 🤮
🔎 Search “KandZ Tools” on Google to use many professional utilities for free.
KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)
⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free
🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!