{"record":{"id":"5ca206311fcc6fc9","repo":"microsoft/semantic-kernel","slug":"the-request-uri-host-host-is-not-allowed-dns","errorCode":null,"errorMessage":"The request URI host '{host}' is not allowed: DNS resolution failed. The request is blocked as a precaution to prevent potential access to private network addresses.","messagePattern":"The request URI host '(.+?)' is not allowed: DNS resolution failed\\. The request is blocked as a precaution to prevent potential access to private network addresses\\.","errorType":"exception","errorClass":"FunctionExecutionException","httpStatus":null,"severity":"error","filePath":"python/semantic_kernel/connectors/openapi_plugin/server_url_validator.py","lineNumber":165,"sourceCode":"        )\n\n    for address in addresses:\n        _ensure_public_address(parsed_url.geturl(), address)\n\n\nasync def _resolve_host(\n    host: str,\n    dns_resolver: DnsResolver | None,\n) -> list[ipaddress.IPv4Address | ipaddress.IPv6Address]:\n    try:\n        if dns_resolver:\n            resolved_addresses = await dns_resolver(host)\n            return [ipaddress.ip_address(address) for address in resolved_addresses]\n\n        loop = asyncio.get_running_loop()\n        addr_info = await loop.getaddrinfo(host, None, type=socket.SOCK_STREAM)\n    except (OSError, ValueError) as exc:\n        raise FunctionExecutionException(\n            f\"The request URI host '{host}' is not allowed: DNS resolution failed. \"\n            \"The request is blocked as a precaution to prevent potential access to private network addresses.\"\n        ) from exc\n\n    addresses: list[ipaddress.IPv4Address | ipaddress.IPv6Address] = []\n    seen_addresses: set[str] = set()\n    for family, _, _, _, sockaddr in addr_info:\n        if family not in (socket.AF_INET, socket.AF_INET6):\n            continue\n        address = ipaddress.ip_address(sockaddr[0])\n        address_string = str(address)\n        if address_string not in seen_addresses:\n            addresses.append(address)\n            seen_addresses.add(address_string)\n    return addresses\n\n\ndef _ensure_public_address(url: str, address: ipaddress.IPv4Address | ipaddress.IPv6Address) -> None:","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/python/semantic_kernel/connectors/openapi_plugin/server_url_validator.py#L147-L183","documentation":"Thrown when DNS resolution itself raised OSError or ValueError (NXDOMAIN, DNS server unreachable, transient resolver failure, or a custom resolver returning a non-IP string). Blocked preemptively because a resolution failure could mask a private/internal address.","triggerScenarios":"getaddrinfo raises OSError for a non-existent domain or unreachable DNS server; a custom dns_resolver raises; or a returned value is not a valid IP (ValueError on ipaddress.ip_address).","commonSituations":"DNS server down or unreachable; hostname does not exist; network partition/firewall blocking DNS; custom resolver implementation error; transient resolver hiccup.","solutions":["Confirm the hostname resolves in your environment (nslookup/dig)","Check DNS server connectivity and retries","If transient, retry the request","If the host is legitimately trusted, add its base URL to allowed_base_urls to skip DNS checks","Ensure a custom dns_resolver returns valid IP address strings and does not raise on normal input"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"import socket\n\ndef host_resolves(host: str) -> bool:\n    try:\n        socket.getaddrinfo(host, None, type=socket.SOCK_STREAM)\n        return True\n    except OSError:\n        return False\n\nif not host_resolves(urlparse(url).hostname):\n    # may be transient; retry or add to allowed_base_urls if trusted\n    ...","typeGuard":null,"tryCatchPattern":"import asyncio\nfrom semantic_kernel.exceptions.function_exceptions import FunctionExecutionException\n\nfor attempt in range(3):\n    try:\n        await validate_server_url(url, options)\n        break\n    except FunctionExecutionException as e:\n        if 'DNS resolution failed' in str(e) and attempt < 2:\n            await asyncio.sleep(2 ** attempt)\n            continue\n        raise","preventionTips":["Confirm DNS is reachable from the runtime environment","Retry transient DNS failures with backoff","Add trusted hosts to allowed_base_urls to skip DNS resolution","Ensure custom dns_resolver does not raise on normal input"],"tags":["dns","network","ssrf","url-validation","retry"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}