/errors/dig/communications-error-connection-refused
;; communications error to 127.0.0.1#53: connection refused
- tool
- dig / nslookup
- exit code
- 9
- versions
- BIND 9.18+, BIND 9.20
- os
- linux, macos, windows
;; communications error to 127.0.0.1#53: connection refused means dig reached the host but nothing accepted DNS on that port: the host answered with "port unreachable" (UDP) or a TCP reset. For a local address such as 127.0.0.1 or 127.0.0.53, the local resolver service is not running. Start it, or point dig and /etc/resolv.conf at a server that is up. In the message, 127.0.0.1#53 is the server address and port dig tried.
How dig reports it
In BIND 9.18 and later, each failed attempt prints a ;; communications error to ADDRESS#PORT: REASON line (the format string is in bin/dig/dighost.c). dig then tries the next server from /etc/resolv.conf or retries; when no server answers, it ends with ;; no servers could be reached and exit status 9. The reason text distinguishes the failures:
| Reason | Meaning |
|---|---|
| connection refused | The host is up and rejects the port: no DNS server listening there |
| timed out | No reply at all: server down, packets dropped by a firewall, or no route |
| host unreachable / network unreachable | No route to that address from this machine |
Check the local resolver
cat /etc/resolv.conf # which server dig uses by default
systemctl status systemd-resolved # 127.0.0.53 is systemd-resolved's stub
ss -lunp | grep ':53 ' # what listens on UDP 53 (root shows the process)
ss -ltnp | grep ':53 '
dig @1.1.1.1 example.com # does DNS work through another server?If resolv.conf lists 127.0.0.53 and systemd-resolved is stopped, restart it (systemctl restart systemd-resolved) or point resolv.conf at a working server. For dnsmasq, unbound or named on 127.0.0.1, restart that service and check its log for a failed bind on port 53 (often because another resolver already holds the port).
Non-standard ports
A local DNS server on another port (a development resolver, a container publishing DNS on 5353) must be queried with -p:
dig @127.0.0.1 -p 5353 example.comWithout -p, dig sends to port 53 and gets connection refused.