Two machines querying the same DNS server can resolve a name differently, with neither having a network or DNS configuration problem: /etc/nsswitch.conf defines the order in which sources get checked to resolve a name, and a different order between the two machines is enough to explain a different result.

What NSS (Name Service Switch) actually controls

nsswitch.conf isn’t only about DNS resolution: it defines, for several categories of system information (hosts, passwd, group, shadow), the ordered list of sources to check and their priority order.

# /etc/nsswitch.conf: default order on most
# modern distributions for name resolution
hosts: files dns

This line means /etc/hosts gets checked first, DNS only kicking in if no matching entry exists there. A stale or wrong entry in /etc/hosts therefore systematically overrides an otherwise correct DNS record, a classic trap when a forgotten test entry in /etc/hosts explains inconsistent resolution that gets searched for in vain on the DNS side.

Why two machines can diverge

A hosts: dns files order on one machine and hosts: files dns on another is enough to produce different results for the same name, if an entry exists in /etc/hosts on one of the two: neither the DNS nor the network differ, only the locally defined lookup order.

# Checks the actually configured order,
# the first step before suspecting DNS itself
cat /etc/nsswitch.conf | grep hosts

The special case of containers

A Docker container or Kubernetes pod usually inherits a minimal NSS configuration, different from the host’s, a frequent source of confusion when comparing the DNS resolution behavior already documented in a Kubernetes context between a container and the machine hosting it: the gap doesn’t necessarily come from the network or from ndots, but potentially from a different nsswitch.conf between the two environments.

Beyond hostnames

The same mechanism applies to passwd and group: a passwd: files ldap entry determines whether local users (/etc/passwd) get checked before a remote LDAP directory, an order that can explain why a user existing in LDAP but also defined locally (with different attributes) doesn’t behave as expected depending on the machine.

Takeaway

/etc/nsswitch.conf defines the lookup order for resolving hostnames, users, and groups, a file that often explains a behavior gap between two machines where DNS or the network otherwise look identical. An entry in /etc/hosts overrides DNS by default on most distributions, a classic trap for a forgotten test entry. Containers usually inherit a minimal NSS configuration different from the host’s, a factor worth checking before looking for the cause of inconsistent resolution on the DNS side itself.