micro/go-micro · error

push callback host %q did not resolve

Error message

push callback host %q did not resolve

What it means

defaultPushURLPolicy requires that a syntactically valid callback host resolve to at least one IP address. This error is thrown when DNS resolution succeeds (no error) but returns an empty result set, meaning the name is defined but has no usable address records. The policy cannot authorize a callback to a host with no addresses.

Source

Thrown at gateway/a2a/pushsecurity.go:47

// defaultPushURLPolicy is the SSRF-safe policy applied when no AllowPushURL is
// configured. It rejects non-http(s) schemes and hosts that resolve to a
// loopback, private, link-local, multicast, or unspecified address.
func defaultPushURLPolicy(u *url.URL) error {
	switch u.Scheme {
	case "http", "https":
	default:
		return fmt.Errorf("push callback scheme %q not allowed (want http or https)", u.Scheme)
	}
	host := u.Hostname()
	if host == "" {
		return fmt.Errorf("push callback url has no host")
	}
	ips, err := resolvePushHost(host)
	if err != nil {
		return fmt.Errorf("push callback host %q: %w", host, err)
	}
	if len(ips) == 0 {
		return fmt.Errorf("push callback host %q did not resolve", host)
	}
	for _, ip := range ips {
		if blockedPushIP(ip) {
			return fmt.Errorf("push callback host %q resolves to a blocked address %s", host, ip)
		}
	}
	return nil
}

func resolvePushHost(host string) ([]net.IP, error) {
	if ip := net.ParseIP(host); ip != nil {
		return []net.IP{ip}, nil
	}
	return pushLookupIP(host)
}

// blockedPushIP reports whether ip is one an outbound push callback must not
// reach: loopback, private (RFC1918 / ULA), link-local (incl. 169.254.169.254

View on GitHub (pinned to 24529f1404)

Solutions

1. Check DNS records for the host (dig A/AAAA/CNAME) and point it at a live address or update the callback URL.
2. Update the push config to a currently live webhook endpoint.
3. If records were just changed, retry after the DNS TTL expires.

Example fix

// before
callback := "https://old-webhook.example.com/hook" // A records removed
// after
callback := "https://webhook.example.com/hook" // live endpoint

addrs, err := net.LookupHost(host)
if err != nil || len(addrs) == 0 {
	return fmt.Errorf("callback host %q has no address records", host)
}

When it happens

Trigger: Calling SetPushNotificationConfig with a hostname whose DNS records were just removed or that only has records of types the resolver ignores (e.g. CNAME pointing to a dead target).

Common situations: Webhook service decommissioned but DNS entry left behind; dangling CNAME; TTL-expired records removed during infra migration while applications still reference the old host.

Related errors

• push callback host %q: %w
• API error: nil response
• ErrIPNotFound
• failed request
• unable to extract port range

AI-assisted analysis of micro/go-micro@24529f1404 (2026-09-01). Data as JSON: /api/errors/570ca9ad0e55c129. Report an issue: GitHub.