Internal hostnames fail on VPN (split DNS / systemd-resolved) Networking Origin: Network OSI layer 7 · Application Last updated 5 Nov 2026

Networking: VPN connected but internal names like db.corp.local don't resolve — split DNS / 127.0.0.53 stub resolver not using the VPN DNS

The VPN works by IP, but internal hostnames fail because queries still go to your normal DNS server.

Exact message you may see systemd-resolved split DNS127.0.0.53 VPN DNS not workinginternal hostnames not resolving over VPNresolvectl status DNS Serverssplit DNS VPN
Explore the map of this error Full error map →
Seen on: Linux Networking

Meaning

With systemd-resolved the system resolver is 127.0.0.53 and each link has its own DNS and search domains. Assign the VPN's DNS server and routing domain to the tunnel interface (resolvectl dns tun0 10.0.0.2, resolvectl domain tun0 ~corp.local) so only internal names go through the VPN.

Common causes

  • VPN DNS server not applied to the tunnel link
  • Missing routing domain (~corp.local)
  • Public DNS answering NXDOMAIN for internal names
  • resolv.conf overwritten by NetworkManager/systemd-resolved
  • Search domain not set

⚡ Quick fix

  1. Inspect: resolvectl status
  2. Set DNS and a routing domain on the VPN link
  3. Test: resolvectl query db.corp.local

Detailed fix by platform

Linux

  1. bash
    resolvectl status
sudo resolvectl dns tun0 10.0.0.2
sudo resolvectl domain tun0 ~corp.local

How to diagnose

  1. Link DNS — VPN server set?
  2. Routing domain — ~corp.local?
  3. Query — Works by IP?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

dig: status: REFUSED (recursion not available) — Networking: dig: status: REFUSED / recursion requested but not available — the DNS server won't resolve queries for you (Networking)dig: status: REFUSED …dig: status: SERVFAIL (DNSSEC validation failed) — Networking: dig: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL — resolver failed to answer (DNSSEC validation or upstream failure) (Networking)dig: status: SERVFAIL…DNS lookups take 5 seconds (timeout then retry) — Networking: Every connection pauses about 5 seconds — resolv.conf nameserver timeout, then fallback to the next DNS server (Networking)DNS lookups take 5 se…Domain still resolves to the old IP (DNS propagation/cache) — Networking: DNS changed but the domain still resolves to the old IP — TTL and resolver caching ("propagation") (Networking)Domain still resolves…IPv6 enabled but broken: slow connections / Happy Eyeballs — Networking: Sites load slowly or hang for seconds — broken IPv6 (AAAA resolves, IPv6 route missing) falling back to IPv4 (Networking)IPv6 enabled but brok…NO_PROPOSAL_CHOSEN (IPsec/IKE) — Networking: IKE: received NO_PROPOSAL_CHOSEN — IPsec peers can't agree on encryption, hash or DH group (Networking)NO_PROPOSAL_CHOSEN (I…Public IP/domain unreachable from inside the LAN (NAT hairpin) — Networking: Server reachable from the internet but not from inside the LAN via its public IP — NAT loopback / hairpin NAT not working (Networking)Public IP/domain unre…Temporary failure in name resolution — ping: google.com: Temporary failure in name resolution (Linux)Temporary failure in …Internal …

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.