DNS resolves, but curl fails: what to check next
A resolved hostname only supplies candidate addresses. Read curl’s connection trace, compare address families, and isolate transport, TLS, proxy, and HTTP failures one layer at a time.
Reviewed by the Terminaster editorial team · Updated
What you will take away
- Successful DNS resolution does not prove an address is reachable or a service is listening.
- Verbose curl output identifies whether failure occurs before connect, during TLS, or after the HTTP request.
- curl --resolve can test a chosen address while preserving the hostname used by HTTP and TLS.
- Do not use -k as a fix for certificate errors; diagnose trust, time, name, and chain instead.
Confirm which DNS answer curl actually uses
A name can resolve to multiple IPv4 and IPv6 addresses. A separate lookup proves that DNS returned data, but curl may select or race addresses differently. Begin with curl’s own verbose output and record each `Trying` line.
Cached answers, search domains, split DNS, and proxy configuration can also make two environments behave differently. Run comparisons from the same host and shell as the failing command.
Compare DNS and curl address selection
getent ahosts service.example
curl -v --connect-timeout 5 --max-time 20 \
https://service.example/ -o /dev/null
curl -4 -v --connect-timeout 5 --max-time 20 https://service.example/ -o /dev/null
curl -6 -v --connect-timeout 5 --max-time 20 https://service.example/ -o /dev/nullLocate the failing layer in verbose output
If curl prints a selected address but never connects, investigate route, firewall, listener, and address-family differences. If TCP connects and TLS fails, inspect the certificate name, chain, trust store, protocol support, and system time. If curl sends an HTTP request and receives a response, the problem has moved to HTTP or the application.
An HTTP 404 or 503 is not a DNS failure. By default, curl can complete successfully at the transport level even when the server returns an error status.
- 1Resolution: did curl obtain the intended addresses?
- 2Connect: did the TCP connection complete to the expected address and port?
- 3TLS: did certificate verification and the handshake succeed?
- 4HTTP: was the request sent, and what status and headers returned?
- 5Application: does the response body or service log explain the failure?
Test one address without changing the hostname
`--resolve` supplies a temporary hostname, port, and address mapping to curl. Unlike replacing the URL hostname with a raw IP address, it preserves the original hostname for HTTP virtual hosting and TLS server-name selection.
This comparison is decisive for a direct curl connection, but a configured proxy may be the actual connection target or may resolve the origin remotely. Compare with `--noproxy '*'` only when direct access is authorized. A successful direct test should be followed by fixing the authoritative record, resolver path, proxy configuration, or unhealthy endpoint.
Pin one HTTPS endpoint for a test
curl -v --connect-timeout 5 --max-time 20 \
--resolve service.example:443:203.0.113.20 \
https://service.example/ -o /dev/nullCheck proxies, TLS trust, and runtime context
curl honors proxy-related environment variables and can use a proxy path even when direct DNS works. Containers may have different DNS, routes, CA bundles, clocks, and proxy settings from the host. Compare relevant configuration without printing secrets into shared logs.
Use `curl -q` at the start of a command when you need to rule out a user curl configuration file. Do not unset organization proxy or trust settings unless you understand why they exist and are authorized to test without them.
Inspect non-secret curl context
curl --version
curl -q -v --connect-timeout 5 --max-time 20 \
https://service.example/ -o /dev/null
env | grep -iE '^(http|https|all|no)_proxy=' \
| sed 's/=.*$/=<set>/'Common questions
Frequently asked questions
Why does ping work while curl fails?
Ping commonly tests ICMP, while curl needs a transport connection to a specific port and then may use TLS and HTTP. Networks can permit one protocol and block or misconfigure another.
Should I use curl -k when the certificate fails?
Not as a fix. It disables peer verification and can hide interception or configuration errors. Check the hostname, system clock, certificate chain, trust store, and intended endpoint instead.
Why does curl work with -4 but fail without it?
The hostname may publish IPv6 and IPv4 while the IPv6 route, firewall, or service path is broken. The comparison identifies an address-family difference; repair or remove the invalid path rather than permanently forcing IPv4 without investigation.
Keep learning
Sources and next steps
Related mental models
Domain Name System (DNS)
The Domain Name System is a distributed, hierarchical database and query protocol that stores typed records under domain names. Resolvers commonly use it to obtain addresses, mail-routing data, aliases, and other information needed by applications.
TLS and HTTPS
TLS establishes an integrity-protected, encrypted channel and can authenticate one or both peers. In ordinary HTTPS, the client authenticates the server name through certificate validation or another configured trust mechanism; client authentication is optional and application-dependent.
HTTP requests with curl
curl is a command-line data-transfer client that uses a URL to select a protocol and exposes options for constructing requests, inspecting transfers, handling failures, and writing response data. For HTTP, its defaults and options map to request methods, fields, content, redirects, and authentication.