Fixing DNS Resolution Failures on AlmaLinux 9: A Systemd‑Resolved Diagnostic Guide

Problem Overview

On AlmaLinux 9 users often report that dig or curl cannot resolve hostnames. The root cause is usually a mis‑configured systemd-resolved service, an incorrect /etc/resolv.conf file, or firewall rules blocking port 53. This guide walks you through a structured diagnostic flow, shows how to verify each step, and applies the appropriate fix.

Diagnostic Checklist

Check	Expected Result	What to Do If It Fails
systemd-resolved is active	Service status shows active (running)	Enable & start, then re‑test.
/etc/resolv.conf is a symlink to /run/systemd/resolve/resolv.conf	Symlink present	Re‑create symlink or correct file contents.
Firewall allows outbound DNS (53/UDP, 53/TCP)	Rule present in default zone	Add rule or temporarily disable firewalld to test.
Configured DNS servers reachable	Direct query succeeds	Replace with known‑good servers.
Network interfaces have DNS settings	Nameserver entries set by NM or systemd‑networkd	Assign static DNS or let NM manage.

Common Causes

• systemd-resolved service stopped or failed.
• /etc/resolv.conf points to a stale or wrong file.
• Firewalld blocks outbound DNS traffic.
• DNS servers are unreachable (network mis‑config, provider outage).
• Network interfaces lack DNS configuration.

Ordered Checks & Fixes

1. Verify systemd‑resolved status

   Run on the host as root or via sudo:

   systemctl status systemd-resolved

   Look for active (running). If it shows inactive (dead) or failed, enable and start:

   systemctl enable --now systemd-resolved

   Risk: Restarting may briefly drop network connectivity. Perform during a maintenance window if the system is critical.

2. Check /etc/resolv.conf

   Examine the file:

   ls -l /etc/resolv.conf
   cat /etc/resolv.conf

   It should be a symlink:

   lrwxrwxrwx 1 root root 34 Oct 16 2026 /etc/resolv.conf -> /run/systemd/resolve/resolv.conf

   If it points elsewhere or contains hard‑coded nameservers, recreate the symlink:

   rm /etc/resolv.conf
   ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf

   Afterward, run systemd-resolve --status to confirm the nameservers listed.

3. Test DNS directly against a known server

   Choose a public resolver (e.g., 1.1.1.1). Replace <DNS-IP> with the IP you want to test:

   dig @<DNS-IP> example.com +short

   Expected output: an IP address. If you receive a timeout or NXDOMAIN, the server is unreachable or blocked.

4. Inspect firewall rules

   List the default zone’s services:

   firewall-cmd --list-all

   Look for dns or port 53/tcp,53/udp in the services or ports sections. If missing, add it:

   firewall-cmd --permanent --add-service=dns
   firewall-cmd --reload

   Alternatively, allow the specific port:

   firewall-cmd --permanent --add-port=53/tcp
   firewall-cmd --permanent --add-port=53/udp
   firewall-cmd --reload

   Risk: Opening DNS ports may expose the host to unwanted traffic. Ensure the host’s security posture remains intact.

5. Validate network interface DNS settings

   Use NetworkManager’s CLI to inspect a specific interface (replace <iface> with the actual name, e.g., eth0):

   nmcli device show <iface> | grep IP4.DNS

   If no DNS entries appear, either let NetworkManager request them from DHCP or set them manually:

   nmcli con mod <connection-name> ipv4.dns "8.8.8.8 8.8.4.4"
   nmcli con up <connection-name>

   For systems using systemd-networkd, check /etc/systemd/network/*.network files for DNS= directives.

6. Re‑run a DNS query after each change

   Use dig @8.8.8.8 example.com or curl -v https://example.com to confirm resolution works. If it still fails, proceed to escalation.

Escalation Criteria

• systemd‑resolved remains inactive after enable/start attempts.
• Firewall rules cannot be added due to policy restrictions.
• DNS servers are unreachable even when queried directly.
• Network interface cannot obtain a DNS address via DHCP.

When any of these conditions persist, involve the network operations team or the upstream ISP. Provide logs from journalctl -u systemd-resolved, firewall-cmd --list-all, and the output of the dig tests.

Summary

DNS resolution failures on AlmaLinux 9 usually boil down to one of four misconfigurations: systemd-resolved not running, /etc/resolv.conf pointing to the wrong file, the firewall blocking port 53, or the network interface lacking proper DNS settings. By following the ordered checks above and applying the corresponding fixes, most issues are resolved quickly.