When systemd‑resolved ignores /etc/hosts: a step‑by‑step fix for local name resolution failures -

Ever had a host you added to /etc/hosts just stop answering? I’ve seen this happen after a kernel upgrade or a quick edit that left a stray comment. On Fedora, Debian, and Arch the culprit is almost always the local resolver: systemd‑resolved. It only reads /etc/hosts if the ResolveFile option is enabled and the service is started with --resolve. A tiny mis‑config can silence that hook.

1. Check that systemd‑resolved is actually running

systemctl status systemd-resolved.service

If you see inactive or failed, start it up:

sudo systemctl enable --now systemd-resolved.service

A classic gotcha: many distros ship a stub systemd‑resolved that’s masked by a static /etc/resolv.conf. Verify the symlink:

ls -l /etc/resolv.conf

It should point to /run/systemd/resolve/stub-resolv.conf. If it’s somewhere else, fix it:

sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf

2. Make sure `/etc/hosts` is actually parsed

Open /etc/systemd/resolved.conf and hunt for ResolveFile=. By default it’s commented out:

#ResolveFile=/etc/hosts

Uncomment it and be explicit:

[Resolve]
ResolveFile=/etc/hosts

Then reload the unit:

sudo systemctl restart systemd-resolved.service

3. Quick sanity check

dig @127.0.0.53 mylocalhost

If you get the IP you put in /etc/hosts, the hook is alive. If not, look at the logs:

journalctl -u systemd-resolved.service | grep hosts

Typical culprits: a malformed line, duplicate entries, or a stray comment that broke the parser. Keep the file lean:

127.0.0.1   localhost
192.168.1.10 myserver

4. Tighten the config

systemd‑resolved ships with a fallback DNS list. If you’re only using local names, let’s cut that route:

[Resolve]
DNS=
FallbackDNS=

Restart again. The benefit? All queries stay local, so you’re not leaking traffic to an external resolver.

5. Verify with the tools you actually use

Both curl and ssh tap into the system resolver. Test them:

curl http://myserver
ssh user@myserver

Both should resolve without hitting any external DNS. If they still fail, double‑check that you don’t have another resolver like dnsmasq or bind9 running and hijacking the resolution chain.

6. When you need something more

If you’re after DNSSEC validation, per‑interface DNS, or other advanced features, you might consider dropping systemd‑resolved in favor of dnsmasq or bind9. In that case, remove the stub symlink and point /etc/resolv.conf straight to your new resolver’s address.

Bottom line
systemd‑resolved can silently ignore /etc/hosts when ResolveFile is commented out or the service is masked. Enabling the unit, pointing /etc/resolv.conf to the stub, and explicitly configuring ResolveFile brings local name resolution back. Tighten the setup by disabling fallback DNS and ensuring no other resolver is clobbering your requests.