ory/hydra · error

failed to resolve %s

Error message

failed to resolve %s

What it means

Returned by IsAssociatedIPAllowed when the DNS lookup of the given hostname (with a 2-second timeout) fails. The hostname could not be resolved to any IP within the deadline, so its addresses cannot be checked against the allow/deny list; the error wraps the underlying net.DNSError with the hostname included.

Source

Thrown at oryx/ipx/ip_validator.go:79

		if !allowed(addr.Addr()) {
			return errors.Errorf("ip %s is not a permitted destination", addr.Addr())
		}
		return nil
	}

	ctx, cancel := context.WithTimeoutCause(ctx, 2*time.Second, errors.New("DNS lookup timed out"))
	defer cancel()
	ips, err := resolver.LookupNetIP(ctx, "ip", ipOrHostname)
	if err != nil {
		if dnsErr, ok := stderrors.AsType[*net.DNSError](err); ok {
			// Copy the `*net.DNSError` before masking `Server` to avoid a data
			// race: the DNS resolver uses `singleflight` to deduplicate
			// concurrent lookups, so multiple goroutines may receive the same
			// `*net.DNSError` pointer. Mutating it in place races with concurrent
			// readers (e.g. the `otelhttp` `dnsDone` trace hook).
			maskedDNS := *dnsErr
			maskedDNS.Server = "" // Mask our DNS server's IP address.
			return errors.Wrapf(&maskedDNS, "failed to resolve %s", ipOrHostnameOrURL)
		}
	}

	for _, ip := range ips {
		if !allowed(ip) {
			return errors.Wrapf(&net.DNSError{
				Err:         "no such host",
				Name:        ipOrHostname,
				Server:      "",
				IsTimeout:   false,
				IsTemporary: false,
				IsNotFound:  true,
			}, "failed to resolve %s", ipOrHostnameOrURL)
		}
	}

	return nil
}

View on GitHub (pinned to 4174065ffb)

Solutions

1. Distinguish net.DNSError: isTemporary/notFound failures may warrant a retry
2. Verify the hostname is spelled correctly and resolvable by the host's resolver
3. Treat resolution failure as denial (fail closed) when the SSRF guard must be strict

When it happens

Trigger: Thrown at oryx/ipx/ip_validator.go:79 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/8a47129f860e4e2f. Report an issue: GitHub.