/errors/dig/connection-timed-out-no-servers-could-be-reached
dig: ;; connection timed out; no servers could be reached
- tool
- dig / nslookup
- exit code
- 9
- versions
- BIND 9.16, BIND 9.18+ (communications error wording)
- os
- linux, macos, windows
;; connection timed out; no servers could be reached means dig sent its query and got no reply from any server it tried, within the timeout (5 seconds per try by default, 3 tries for UDP). It is not an answer from DNS: no server answered at all, so this is a network or resolver availability problem, not a missing record. dig exits with status 9. Query a public resolver (dig @1.1.1.1 example.com) to find out whether the problem is your configured DNS server or the network.
Message variants
Older BIND releases (9.16 and earlier) print a single line:
;; connection timed out; no servers could be reachedBIND 9.18 and later print one line per failed attempt and then a summary:
;; communications error to 192.0.2.53#53: timed out
;; communications error to 192.0.2.53#53: timed out
;; communications error to 192.0.2.53#53: timed out
;; no servers could be reached192.0.2.53#53 is the server address and port. Both forms mean the same thing.
Narrow it down
dig example.com # uses the servers from /etc/resolv.conf
dig @1.1.1.1 example.com # a public resolver over UDP
dig @1.1.1.1 example.com +tcp # the same over TCP (UDP filtered?)
dig @192.0.2.53 example.com +time=5 +tries=3 # slower server, more patience
cat /etc/resolv.conf
resolvectl status # systemd-resolved: per-link DNS servers| Result | Likely cause |
|---|---|
| Default fails, @1.1.1.1 works | The configured resolver is down, wrong or blocked; fix resolv.conf or the resolver service |
| Both fail over UDP, +tcp works | UDP port 53 is filtered on the path |
| Everything times out | No network or all outgoing DNS blocked (firewall, captive portal, container network) |
| Only one authoritative server fails | That server is down or drops queries from you; other NS records may still answer |
Exit codes
dig returns 0 when it got a response (even NXDOMAIN or SERVFAIL, which you read in the status: field), 1 for usage errors, 8 when it cannot open a batch file, 9 when no reply was received and 10 for internal errors. Scripts should check both the exit code and the status: line.