{"record":{"id":"7879169a211ace1b","repo":"cloudflare/cloudflared","slug":"unable-to-resolve-host-to-confirm-access","errorCode":null,"errorMessage":"unable to resolve host to confirm access","messagePattern":"unable to resolve host to confirm access","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"socks/request_handler.go","lineNumber":58,"sourceCode":"\t\treturn h.handleBind(conn, req)\n\tcase associateCommand:\n\t\treturn h.handleAssociate(conn, req)\n\tdefault:\n\t\tif err := sendReply(conn, commandNotSupported, nil); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to send reply: %v\", err)\n\t\t}\n\t\treturn fmt.Errorf(\"Unsupported command: %v\", req.Command)\n\t}\n}\n\n// handleConnect is used to handle a connect command\nfunc (h *StandardRequestHandler) handleConnect(conn io.ReadWriter, req *Request) error {\n\tif h.accessPolicy != nil {\n\t\tif req.DestAddr.IP == nil {\n\t\t\taddr, err := net.ResolveIPAddr(\"ip\", req.DestAddr.FQDN)\n\t\t\tif err != nil {\n\t\t\t\t_ = sendReply(conn, ruleFailure, req.DestAddr)\n\t\t\t\treturn fmt.Errorf(\"unable to resolve host to confirm access\")\n\t\t\t}\n\n\t\t\treq.DestAddr.IP = addr.IP\n\t\t}\n\t\tif allowed, rule := h.accessPolicy.Allowed(req.DestAddr.IP, req.DestAddr.Port); !allowed {\n\t\t\t_ = sendReply(conn, ruleFailure, req.DestAddr)\n\t\t\tif rule != nil {\n\t\t\t\treturn fmt.Errorf(\"Connect to %v denied due to iprule: %s\", req.DestAddr, rule.String())\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"Connect to %v denied\", req.DestAddr)\n\t\t}\n\t}\n\n\ttarget, localAddr, err := h.dialer.Dial(req.DestAddr.Address())\n\tif err != nil {\n\t\tmsg := err.Error()\n\t\tresp := hostUnreachable\n\t\tif strings.Contains(msg, \"refused\") {","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/socks/request_handler.go#L40-L76","documentation":"When an access control policy is configured, handleConnect must resolve the destination FQDN to an IP so the policy can be evaluated by address. If net.ResolveIPAddr fails for the hostname, the handler sends a ruleFailure reply and returns this error. The request is never dialed, so no access decision could be made.","triggerScenarios":"handleConnect with a non-nil accessPolicy, req.DestAddr.IP == nil, and net.ResolveIPAddr(\"ip\", req.DestAddr.FQDN) returning an error — DNS lookup failure (NXDOMAIN, no resolver, timeout).","commonSituations":"Clients requesting destinations for hostnames that don't exist; the proxy host lacking DNS resolution (broken /etc/resolv.conf, offline environment, no DNS in container); typo'd hostnames in application config.","solutions":["Fix DNS resolution on the proxy host (check /etc/resolv.conf, nameserver reachability, container dns settings)","Verify the destination hostname is correct and resolvable (dig/nslookup from the proxy host)","Send IP-literal destinations from the client to skip the resolve step","If DNS is optional in your deployment, supply an access policy that doesn't require resolution or preload req.DestAddr.IP"],"exampleFix":"// before: hostname fails DNS in airgapped env\naddr, err := net.ResolveIPAddr(\"ip\", \"internal.example.corp\")\n\n// after: ensure DNS or use IP\ntarget := \"10.0.0.5\" // or fix nameserver config\naddr, err := net.ResolveIPAddr(\"ip\", target)","handlingStrategy":"fallback","validationCode":"// pre-resolve hostname before sending the request\nif _, err := net.ResolveIPAddr(\"ip\", host); err != nil {\n    return fmt.Errorf(\"destination %s does not resolve: %w\", host, err)\n}","typeGuard":"func isResolvable(host string) bool {\n    _, err := net.ResolveIPAddr(\"ip\", host)\n    return err == nil\n}","tryCatchPattern":"if err := proxy.Connect(host); err != nil && strings.Contains(err.Error(), \"unable to resolve host\") {\n    // fall back to IP literal or fail fast in caller\n}","preventionTips":["Verify DNS works from the proxy host (resolv.conf, container dns)","Send IP literals for known-static internal hosts","Monitor resolver health; alert on resolution failure spikes"],"tags":["network","dns","socks5","access-policy"],"backgroundTag":"resource-not-found","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}