Realm sync times out after DNS migration: Is DNS caching causing the issue?

Question

Problem Context
After moving the Realm Object Server to a new IP address, clients report a persistent connection timeout when attempting to open a synced Realm. The SDK continues to use the previous DNS entry, resulting in a failed WebSocket handshake.
Constraints & Uncertainty

The Realm SDK relies on the platform’s DNS resolver, which may cache entries for extended periods.
SSL/TLS validation uses the OS trust store; any change in the server certificate (e.g., new CA or self‑signed cert) must be explicitly trusted.
WebSocket upgrade requests must reach the current server endpoint before the SSL/TLS handshake completes.

Unresolved Questions

What mechanism does the Realm SDK expose to force a fresh DNS lookup for the server host?
How can we verify that the updated server certificate is being presented and trusted during the handshake?
Is there a diagnostic API or log level that reveals whether the SDK is using a stale DNS entry or encountering a certificate validation error?

Tasadduq Burney · Answer

Is DNS Caching Causing the Timeout?
Yes, DNS caching is the most likely cause if the SDK is attempting to connect to a stale IP address. Because the Realm SDK relies on the underlying operating system's network stack for name resolution, it does not maintain its own internal DNS cache. If the OS has cached the previous IP address, the WebSocket handshake will fail at the TCP layer, resulting in a connection timeout before the SSL/TLS handshake even begins.

Analysis of Failure Modes
To resolve this, it is critical to distinguish between a network-level timeout and a security-level rejection. These two scenarios present differently in the connection lifecycle:

Symptom
      Likely Cause
      Behavior

Connection Timeout
      Stale DNS / Firewall
      TCP SYN packets are sent to the old IP and receive no response.

Handshake Failure / SSL Error
      Certificate Mismatch
      TCP connection succeeds, but the TLS handshake fails due to an untrusted or mismatched certificate.

Resolution Steps
Since the Realm SDK does not expose a manual "force refresh" method for DNS, you must address the issue at the OS or network level:

Flush Client DNS: Restart the client application or the device to clear the OS-level DNS cache. For development environments, manually flush the DNS cache via the command line (e.g., sudo dscacheutil -flushcache on macOS).
  Verify Resolution: Use a tool like nslookup or dig on the client device to confirm the host resolves to the new IP address.
  Inspect Traffic: Use a network interceptor (such as Charles Proxy or Wireshark) to verify the destination IP of the WebSocket upgrade request. If the request is hitting the old IP, the issue is definitively DNS caching.
  Enable Debug Logging: Set the Realm SDK log level to Debug. This will reveal the specific endpoint URL being targeted and help differentiate between a socket timeout and a TLS certificate error.

Required Diagnostic Detail
To provide a more specific recommendation, please clarify: Are the timeouts occurring across all client platforms (iOS, Android, Web) or only on a specific OS? DNS caching behavior and TTL adherence vary significantly between mobile operating systems.

Realm sync times out after DNS migration: Is DNS caching causing the issue?

Problem Context

Constraints & Uncertainty

Unresolved Questions

1 answer

Is DNS Caching Causing the Timeout?

Analysis of Failure Modes

Resolution Steps

Required Diagnostic Detail

Your perspective belongs here.

1 question comment

Re‑open Realms to Trigger a New DNS Resolution

Practical Steps

Symptom	Likely Cause	Behavior
Connection Timeout	Stale DNS / Firewall	TCP SYN packets are sent to the old IP and receive no response.
Handshake Failure / SSL Error	Certificate Mismatch	TCP connection succeeds, but the TLS handshake fails due to an untrusted or mismatched certificate.