--- title: Does Alpine resolve DNS properly? (2021) | daily.dev description: Alpine Linux containers use musl libc instead of glibc, and musl's DNS resolver intentionally does not fall back to TCP when a UDP DNS response has the TC... canonical: https://daily.dev/posts/does-alpine-resolve-dns-properly-2021--jkqxdqe7m twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Does Alpine resolve DNS properly? (2021) | daily.dev og:description: Alpine Linux containers use musl libc instead of glibc, and musl's DNS resolver intentionally does not fall back to TCP when a UDP DNS response has the TC... og:url: https://daily.dev/posts/does-alpine-resolve-dns-properly-2021--jkqxdqe7m og:image: https://api.daily.dev/og/posts/jkQxdQe7M.png og:image:alt: Does Alpine resolve DNS properly? (2021) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Does Alpine resolve DNS properly? (2021) **[Lobsters](https://daily.dev/sources/lobsters)** · 5 min read · 3 upvotes · 3 comments ## Summary Alpine Linux containers use musl libc instead of glibc, and musl's DNS resolver intentionally does not fall back to TCP when a UDP DNS response has the TC (Truncation) bit set. This means Alpine containers silently fail to resolve DNS names whose responses exceed 512 bytes. The issue was diagnosed using strace and tcpdump inside a Kubernetes sidecar container, revealing that CoreDNS returned a truncated UDP response that musl simply discarded. The fix was switching the container base image from Alpine to Red Hat UBI8, which uses glibc and handles TCP DNS fallback correctly. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does DNS resolution fail for some hostnames in an Alpine Linux container but work fine on a regular Linux host? Musl libc's DNS resolver, used by Alpine, does not retry over TCP when a UDP DNS response has the truncation (TC) bit set, unlike glibc. If a DNS answer is too large for a 512-byte UDP packet, the server sets the TC bit expecting a TCP retry, but musl's resolver simply gives up, returning no records and exit code 2 from getent hosts. _Anyone hitting silent DNS failures in Alpine containers can compare notes on musl vs glibc behavior via daily.dev._ ### Is musl libc's lack of TCP fallback for DNS resolution a bug or intentional design? It is intentional, not a bug. The musl libc author deliberately chose not to implement TCP DNS fallback, believing UDP-only resolution is better for performance and user experience, even though this means any oversized DNS response causes resolution to fail entirely on musl-based systems like Alpine. _Developers weighing musl's tradeoffs against glibc can track these container base-image nuances on daily.dev._ ### How can I fix DNS resolution failures caused by musl libc in an Alpine-based container? Switch the container's base image from Alpine to one using glibc, such as RedHat's UBI8 image, since glibc's resolver correctly falls back to TCP when a UDP DNS response is truncated. Shrinking the oversized DNS record is an alternative fix, but is often impractical if the DNS entry isn't under your team's control. _Teams migrating container base images to fix DNS quirks can compare glibc versus musl tradeoffs on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 4 discussions and 19 comments across hackernews, lobsters (as of 2026-09-14). **TL;DR:** The community largely treats this as a historical issue — musl's lack of DNS-over-TCP fallback was a real and frustrating gotcha, but it was fixed in Alpine 3.18 (May 2023). Commenters are split between 'just avoid Alpine' and 'run your own local resolver and you'll never hit this.' **Sentiment:** 20% positive · 50% mixed · 30% skeptical **The case for** - Running a local caching resolver (e.g., Unbound or dnsmasq) on each node sidesteps the issue entirely and brings additional benefits like logging, TTL control, and DoH/DoT forwarding. - musl is largely standards-compliant and the DNS-over-TCP gap was essentially the only major glaring issue with it outside of proprietary software. - The fix landed in Alpine 3.18, so modern Alpine images are no longer affected. **The pushback** - musl intentionally omitted DNS-over-TCP fallback, violating RFC 7766 (2016), which mandates stub resolvers MUST support DNS-over-TCP — commenters call this a design-level bug. - Swapping a core libc component introduces subtle compatibility surprises that are hard to diagnose, as this DNS truncation failure illustrates. - The failure mode is silent — truncated UDP responses are simply discarded — making it very difficult to debug without tools like strace and tcpdump. **By community** - hackernews (mixed): Commenters note the issue is now resolved in Alpine 3.18 and recommend running a local resolver as a general best practice regardless of distro. - lobsters (mixed): Discussion is lively: most agree the DNS-over-TCP omission was a real (now-fixed) bug, with debate over whether musl's non-glibc approach is a feature or a liability. **Hottest debate:** Whether musl's original decision to omit DNS-over-TCP fallback was a legitimate design choice or simply a bug, and whether Alpine is trustworthy as a base image at all. **Open questions** - Are there other subtle behavioral differences between musl and glibc that could cause similarly hard-to-diagnose failures in production? - Should proprietary and third-party software be expected to statically link their own libc to avoid musl/glibc compatibility issues? **Highlights** > As it happens, musl began supporting DNS over TCP this May. > — [adsouza on lobsters · 20 points](https://lobste.rs/s/ut2cny/does_alpine_resolve_dns_properly_2021#c_q59hdw) > The article is missing a reference to [RFC 7766](https://www.rfc-editor.org/rfc/rfc7766#page-6) which clarified in 2016 that stub resolvers MUST implement DNS-over-TCP. There’s a whole series of RFCs about DNS over TCP because of boneheads who break things by not supporting it. > — [fanf on lobsters · 12 points](https://lobste.rs/s/ut2cny/does_alpine_resolve_dns_properly_2021#c_afnxal) > > I expected this to be a bug, but it turned out that this is a functional difference between musl libc and glibc and is by design. That doesn't mean it's not a bug. It's just a bug in the design rather than in the implementation. > — [technomancy on lobsters · 8 points](https://lobste.rs/s/ut2cny/does_alpine_resolve_dns_properly_2021#c_hrqpm2) > It does work well. The DNS issue (which is now resolved) was basically the only glaring issue with musl outside of proprietary software (which often depends on glibc, IMO they should statically link their libc but glibc doesn’t really support that) > — [pmc on lobsters · 4 points](https://lobste.rs/s/ut2cny/does_alpine_resolve_dns_properly_2021#c_rwbmiv) > Regardless of what distro I use, I always have Unbound DNS running on each node to cache responses. Perhaps that is why I have never run into DNS issues on Alpine which I use exclusively on routers, firewalls and servers. I've never been a fan of relying on the resolvers in either glibc or muslc. Unbound gives me more reliability, retries, logging, ability to override individual records or entire zones, cap the min and max TTL, forward to DoH/DoT and more. > — [LinuxBender on hackernews](https://news.ycombinator.com/item?id=35263814) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=42013219) · 2 points · 2 comments - [hackernews](https://news.ycombinator.com/item?id=35259110) · 1 points · 4 comments - [hackernews](https://news.ycombinator.com/item?id=36625045) · 1 points · 2 comments - [lobsters](https://lobste.rs/s/ut2cny/does_alpine_resolve_dns_properly_2021) · 10 points · 11 comments ## Community discussion Top comments from developers on daily.dev. **@dcorto** · 1 upvotes > it's always DNS **@agustinbarrientos** · 0 upvotes > I think a truncated DNS response belongs in every image smoke test. **@saikiran66** · 0 upvotes > `musl 1.2.4` has the TCP fall back. > If you are using **Alpine 3.18 or newer**, Alpine resolves DNS perfectly fine and will correctly fall back to TCP for large CoreDNS payloads. ## Similar posts on daily.dev - [Performance and load testing in Identity Management \(IdM\) systems using encrypted DNS \(eDNS\) and CoreDNS in OpenShift clusters](https://daily.dev/posts/performance-and-load-testing-in-identity-management-idm-systems-using-encrypted-dns-edns-and-cor-lgmzaaex5) · Red Hat Developer · 0 upvotes · 0 comments - [Bug Report: macOS 26 breaks /etc/resolver/ supplemental DNS for custom TLDs](https://daily.dev/posts/bug-report-macos-26-breaks-etc-resolver-supplemental-dns-for-custom-tlds-j23fozekh) · Hacker News · 0 upvotes · 0 comments - [It works on my cluster: a tale of two troubleshooters](https://daily.dev/posts/it-works-on-my-cluster-a-tale-of-two-troubleshooters-yryuuxuyi) · OctopusDeploy · 6 upvotes · 1 comments - [So long, and thanks for all the fish: how to escape the Linux networking stack](https://daily.dev/posts/so-long-and-thanks-for-all-the-fish-how-to-escape-the-linux-networking-stack-jwvm9hpw7) · Cloudflare · 29 upvotes · 1 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#containers](https://daily.dev/tags/containers), [#dns](https://daily.dev/tags/dns) [View this post on daily.dev](https://daily.dev/posts/does-alpine-resolve-dns-properly-2021--jkqxdqe7m) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Does Alpine resolve DNS properly? (2021)","url":"https://daily.dev/posts/does-alpine-resolve-dns-properly-2021--jkqxdqe7m","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/does-alpine-resolve-dns-properly-2021--jkqxdqe7m"},"datePublished":"2026-08-11T02:28:04.254Z","dateModified":"2026-09-14T07:18:00.473Z","description":"Alpine Linux containers use musl libc instead of glibc, and musl's DNS resolver intentionally does not fall back to TCP when a UDP DNS response has the TC...","image":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","thumbnailUrl":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":3,"discussionUrl":"https://daily.dev/posts/does-alpine-resolve-dns-properly-2021--jkqxdqe7m","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":3}],"keywords":"kubernetes,containers,dns","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"Does Alpine resolve DNS properly? (2021)"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/does-alpine-resolve-dns-properly-2021--jkqxdqe7m","comment":[{"@type":"Comment","text":"it’s always DNS","datePublished":"2026-08-11T13:06:16.611Z","url":"https://daily.dev/posts/jkQxdQe7M#c-V7vEMklFy","author":{"@type":"Person","name":"David C.","url":"https://daily.dev/dcorto","image":"https://media.daily.dev/image/upload/s--EPnTZZFw--/f_auto/v1784418453/avatars/avatar_tT4BuvxaHeTxyE5fH41si?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"I think a truncated DNS response belongs in every image smoke test.","datePublished":"2026-08-12T02:27:32.257Z","url":"https://daily.dev/posts/jkQxdQe7M#c-tcZXJvC0J","author":{"@type":"Person","name":"Agustin Barrientos","url":"https://daily.dev/agustinbarrientos","image":"https://media.daily.dev/image/upload/s--5ayxQnqn--/f_auto/v1788281802/avatars/avatar_wQYYVe5Tbj0NJ7C7qPoa8?_a=BAMAMicg0"}},{"@type":"Comment","text":"musl 1.2.4 has the TCP fall back.\nIf you are using Alpine 3.18 or newer, Alpine resolves DNS perfectly fine and will correctly fall back to TCP for large CoreDNS payloads.","datePublished":"2026-08-12T18:58:07.682Z","dateModified":"2026-08-12T18:59:19.278Z","url":"https://daily.dev/posts/jkQxdQe7M#c-d5jUQcf3B","author":{"@type":"Person","name":"Saikiran","url":"https://daily.dev/saikiran66"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/does-alpine-resolve-dns-properly-2021--jkqxdqe7m#faq","mainEntity":[{"@type":"Question","name":"Why does DNS resolution fail for some hostnames in an Alpine Linux container but work fine on a regular Linux host?","acceptedAnswer":{"@type":"Answer","text":"Musl libc's DNS resolver, used by Alpine, does not retry over TCP when a UDP DNS response has the truncation (TC) bit set, unlike glibc. If a DNS answer is too large for a 512-byte UDP packet, the server sets the TC bit expecting a TCP retry, but musl's resolver simply gives up, returning no records and exit code 2 from getent hosts. Anyone hitting silent DNS failures in Alpine containers can compare notes on musl vs glibc behavior via daily.dev."}},{"@type":"Question","name":"Is musl libc's lack of TCP fallback for DNS resolution a bug or intentional design?","acceptedAnswer":{"@type":"Answer","text":"It is intentional, not a bug. The musl libc author deliberately chose not to implement TCP DNS fallback, believing UDP-only resolution is better for performance and user experience, even though this means any oversized DNS response causes resolution to fail entirely on musl-based systems like Alpine. Developers weighing musl's tradeoffs against glibc can track these container base-image nuances on daily.dev."}},{"@type":"Question","name":"How can I fix DNS resolution failures caused by musl libc in an Alpine-based container?","acceptedAnswer":{"@type":"Answer","text":"Switch the container's base image from Alpine to one using glibc, such as RedHat's UBI8 image, since glibc's resolver correctly falls back to TCP when a UDP DNS response is truncated. Shrinking the oversized DNS record is an alternative fix, but is often impractical if the DNS entry isn't under your team's control. Teams migrating container base images to fix DNS quirks can compare glibc versus musl tradeoffs on daily.dev."}}]} ```