apache/hadoop · error · IllegalArgumentException

hadoop.security.dns.nameserver requires hadoop.security.dns.

Error message

hadoop.security.dns.nameserver requires hadoop.security.dns.interface. Check yourconfiguration.

What it means

SecurityUtil.getLocalHostName resolves the local hostname used for Kerberos login. DNS-based resolution is driven by hadoop.security.dns.interface, optionally paired with hadoop.security.dns.nameserver. Setting the nameserver without the interface is rejected with IllegalArgumentException because the resolver has no interface to bind the nameserver to. (The literal message contains the known typo 'yourconfiguration' with a missing space.)

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java:272

   * Retrieve the name of the current host. Multihomed hosts may restrict the
   * hostname lookup to a specific interface and nameserver with {@link
   * org.apache.hadoop.fs.CommonConfigurationKeysPublic#HADOOP_SECURITY_DNS_INTERFACE_KEY}
   * and {@link org.apache.hadoop.fs.CommonConfigurationKeysPublic#HADOOP_SECURITY_DNS_NAMESERVER_KEY}
   *
   * @param conf Configuration object. May be null.
   * @return
   * @throws UnknownHostException
   */
  static String getLocalHostName(@Nullable Configuration conf)
      throws UnknownHostException {
    if (conf != null) {
      String dnsInterface = conf.get(HADOOP_SECURITY_DNS_INTERFACE_KEY);
      String nameServer = conf.get(HADOOP_SECURITY_DNS_NAMESERVER_KEY);

      if (dnsInterface != null) {
        return DNS.getDefaultHost(dnsInterface, nameServer, true);
      } else if (nameServer != null) {
        throw new IllegalArgumentException(HADOOP_SECURITY_DNS_NAMESERVER_KEY +
            " requires " + HADOOP_SECURITY_DNS_INTERFACE_KEY + ". Check your" +
            "configuration.");
      }
    }

    // Fallback to querying the default hostname as we did before.
    return InetAddress.getLocalHost().getCanonicalHostName();
  }

  /**
   * Login as a principal specified in config. Substitute $host in
   * user's Kerberos principal name with a dynamically looked-up fully-qualified
   * domain name of the current host.
   * 
   * @param conf
   *          conf to use
   * @param keytabFileKey
   *          the key to look for keytab file in conf

View on GitHub (pinned to 2add963021)

Solutions

1. Add hadoop.security.dns.interface (e.g. eth0 or bond0) alongside the nameserver
2. Or remove hadoop.security.dns.nameserver to fall back to default host resolution
3. Verify the interface name exists on every node with 'ip addr' or 'ifconfig'
4. Add a config-pairing check to deployment automation so the two keys always ship together

Example fix

<!-- before -->
<property><name>hadoop.security.dns.nameserver</name><value>10.0.0.53</value></property>

<!-- after -->
<property><name>hadoop.security.dns.interface</name><value>eth0</value></property>
<property><name>hadoop.security.dns.nameserver</name><value>10.0.0.53</value></property>

String iface = conf.get("hadoop.security.dns.interface");
String ns = conf.get("hadoop.security.dns.nameserver");
if (ns != null && iface == null) {
  throw new IllegalArgumentException(
      "Set hadoop.security.dns.interface when configuring hadoop.security.dns.nameserver");
}

When it happens

Trigger: core-site.xml defines hadoop.security.dns.nameserver (e.g. 10.0.0.53) but omits hadoop.security.dns.interface; the first SecurityUtil.login or getLocalHostName call during daemon startup then throws.

Common situations: Operators copy only one of the two keys between clusters, or set the nameserver expecting it to work standalone; the failure surfaces at daemon startup after enabling Kerberos.

Related errors

• Invalid rule: ${remaining}
• Running in secure mode, but config doesn't have a keytab for
• Security is enabled but block access tokens (via dfs.block.a
• No secret in signature secret file: ${signatureSecretFile}
• Invalid rule mechanism: ${ruleMech}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/6efa9253568373d8. Report an issue: GitHub.