Home / OCI

OCITroubleshootingIntermediate

Sev1: OCI DNS record or private view changed — names stop resolving

Restore name resolution after a public zone record, private zone, private view or VCN resolver change in OCI DNS. Check the record, the resolver's attached views and forwarding rules, revert from Audit details, and lower TTLs for the next change.

Deepak Bhardwaj2 min read

Applies toOCI DNS public zones, private DNS zones, private views, VCN resolvers with endpoints, OCI CLI 3.x

Symptoms

  • NXDOMAIN or wrong answers for app names; clients fail to reach databases or APIs by hostname.
  • Only resolution from inside a VCN fails (private DNS), or only public resolution fails.

1. Test from the right place

dig +short app.example.com @8.8.8.8          # public view
dig +short db01.prod.oraclevcn.com           # from an instance in the VCN (uses 169.254.169.254)
dig +short app.corp.internal                 # private zone

2. Public zone record

oci dns record rrset get --zone-name-or-id example.com --domain app.example.com --rtype A

Restore a missing record:

oci dns record rrset update --zone-name-or-id example.com --domain app.example.com --rtype A \
  --items '[{"domain":"app.example.com","rtype":"A","rdata":"203.0.113.20","ttl":300}]' --force

rrset update replaces all records of that type for the name — include every value you need.

Check the zone's delegation still points at OCI nameservers (the registrar's NS records):

dig +short NS example.com
oci dns zone get --zone-name-or-id example.com --query 'data.nameservers[].hostname'

3. Private DNS: views and resolver

Private zones only answer if their view is attached to the VCN's resolver.

VCN_RESOLVER=$(oci network vcn-dns-resolver-association get --vcn-id $VCN --query 'data."dns-resolver-id"' --raw-output)
oci dns resolver get --resolver-id $VCN_RESOLVER --scope PRIVATE \
  --query 'data.{default:"default-view-id", views:"attached-views"[]."view-id", rules:rules, endpoints:endpoints}'
oci dns zone list --compartment-id $C --scope PRIVATE --view-id <view-ocid> --output table
Finding Fix
Custom view detached from the resolver Re-attach it (oci dns resolver update --attached-views ...)
Zone moved to a different view Move back or attach that view
Forwarding rule to on-prem DNS removed Re-add the rule and forwarding endpoint
Listening endpoint removed On-prem conditional forwarders now fail — re-create it with the same IP

Warning

oci dns resolver update --attached-views replaces the whole list of attached views. Pass every view the resolver needs.

4. Find the change

oci audit event list --compartment-id $C --start-time $(date -u -d '-12 hours' +%FT%TZ) --end-time $(date -u +%FT%TZ) --all \
  --query 'data[?contains("data"."event-source", `dns`) || contains("data"."event-name", `Resolver`)].{t:"event-time", e:"data"."event-name", who:"data"."identity"."principal-name"}' --output table

5. Caches

Clients may hold the old answer for the record's TTL. Flush where you can (systemd-resolve --flush-caches / resolvectl flush-caches, ipconfig /flushdns, restart app connection pools).

Prevent it next time

  • DNS zones, views and resolvers in Terraform with review.
  • Lower TTLs (60–300s) on records you change often or before migrations.
  • Synthetic checks resolving critical names from inside each VCN and from the internet.

Related fixes