highAdvancedSymptom-first#proxy#dns#browser#pac#wpad

dig resolves but browser/app cannot reach the host -- proxy or DNS interception

dig and nslookup resolve the hostname correctly but curl/browser gets ERR_NAME_NOT_RESOLVED

Likely source:configurationconnectivity

Focused incident mode — strips away everything but this runbook.

Symptoms

  • dig and nslookup resolve the hostname correctly but curl/browser gets ERR_NAME_NOT_RESOLVED
  • curl works without proxy but fails with --proxy or through system proxy settings
  • The app resolves via a different DNS path than the system resolver

Modern browsers increasingly use DoH which bypasses the OS resolver entirely. For internal-only names, ensure the browser DoH bypass list includes your corporate domains.

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • System proxy environment

    env | grep -iE 'proxy|PROXY'

  • Browser DNS vs system DNS

    dig <host> +short && curl -v https://<host> 2>&1 | head -20

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • HTTP_PROXY or HTTPS_PROXY is set in the environment
  • dig works but curl through proxy fails with resolution error

Confirm before fixing

curl -x http://<proxy>:<port> -v https://<host> 2>&1 | grep -i 'resolve|connect'
READ

Force curl through the proxy to see if resolution works there

Fix

export no_proxy='<host>,localhost,127.0.0.1'
CHANGE

Add the host to the no_proxy bypass list

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
dig <host> +short
READ

Confirm DNS works at the system level

2
env | grep -iE 'proxy|PROXY'
READ

Check for proxy environment variables

3
curl -v https://<host> 2>&1 | head -30
READ

See where the connection fails (DNS, proxy, or TLS)

4
curl --noproxy '*' -v https://<host> 2>&1 | head -30
READ

Bypass proxy to confirm it is the proxy causing the failure

Prevention

  • Set no_proxy for all internal domains in the environment.
  • Disable DoH for internal domains or configure a corporate DoH endpoint.
  • Document the expected DNS resolution path for every environment (direct vs proxy).
  • Test app connectivity with and without proxy settings during onboarding.

Related runbooks

Same stack, same failure family — worth a skim.

DNS returns NXDOMAIN for a record that exists -- stale resolver or propagation delayhigh

dig/nslookup returns NXDOMAIN for a domain that was recently updated

NetworkingIntermediate3 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.