KMMR Note

Practical notes for developers and system engineers

HOME > DNS fails only in WSL? Compare Windows lookup and curl errors

DNS fails only in WSL? Compare Windows lookup and curl errors

A website opens in your Windows browser, but a request from Linux inside WSL fails. Before changing DNS servers, compare how Windows and Linux resolve the same hostname, then check whether the request reaches an HTTP response. That gives you a more useful starting point for the next investigation.

These checks use Windows PowerShell on the Windows side and getent and curl inside a WSL 2 Linux distribution. Replace example.com with the hostname you need to investigate. Leave off https:// and any URL path when passing a name to a name-resolution command.

Contents

Check the DNS response in Windows

In Windows PowerShell, request the IPv4 A records.

Resolve-DnsName -Name example.com -Type A -DnsOnly | Select-Object Name, Type

A row with Type A shows that this query returned an IPv4 record for the name. Some services have no A record, and internal names may only resolve on a particular network. An empty result alone does not establish a general network failure. For AAAA records and DNS server checks, see troubleshooting Windows DNS with Resolve-DnsName.

Look up the same name inside WSL

Run the next command in the Linux distribution where your application fails. If you have several distributions or containers, a successful check in another one may not describe the application’s environment.

getent hosts example.com

Look for an address and hostname in the output. getent uses the Linux environment’s name lookup facilities, so this is not identical to a direct DNS query. Local hosts entries and the implementation’s lookup configuration can also affect the result. Different addresses from the Windows A query are not automatically an error: address families and the service’s DNS responses can differ.

If Windows returns a result but this Linux lookup does not, investigate the WSL lookup path and where the name is valid. If neither returns a result, the spelling, the service’s DNS records, and your network connection are useful first checks.

Separate HTTPS failures from name lookup failures

Once Linux returns an address, request the response headers from the same Linux terminal. This example allows five seconds to establish the connection and ten seconds for the whole operation. A slow network or service can exceed these short limits.

curl -I --connect-timeout 5 --max-time 10 https://example.com/

HTTP headers and a status code show that this request received an HTTP response. HEAD support, authentication, and redirects still depend on the service. An HTTP 403 response gives you a different starting point from a failure to resolve the hostname.

curl error 6 means the destination hostname could not be resolved. Error 28 means an operation exceeded its time limit; it is not specific to DNS. Read the accompanying message, such as Resolving timed out, to identify the stage that was waiting. A certificate error calls for a TLS investigation rather than disabling certificate verification.

A configured proxy can also change the request path. Your Windows browser, getent, and curl do not necessarily use the same route or lookup mechanism, so a short result should guide the next check rather than settle the cause.

Review VPN and WSL DNS settings in context

Microsoft describes DNS tunneling for WSL on Windows 11 22H2 and later. It handles DNS through a virtualization mechanism and is intended to improve compatibility with VPNs and more complex networks. The requirements of a particular organization’s VPN still matter.

When reviewing existing settings, distinguish the Windows-side .wslconfig file from the distribution’s /etc/wsl.conf. The generateResolvConf setting controls whether WSL generates /etc/resolv.conf. If an earlier workaround added manual settings, compare those changes with the current Microsoft configuration guidance before making further changes.

Names that work only on a corporate network may require that organization’s DNS and VPN configuration. Replacing DNS with a public resolver, disconnecting the VPN, or turning off protection can break other connections or internal name lookup. Results for the same name from Windows and Linux at the same time can help your administrator investigate within the permitted environment.

If the failing task is access from Windows to a web app running inside WSL, start with the WSL localhost and listening-port checks. The direction of that connection differs from a Linux application’s request to an external hostname.

References