Diagnosing name resolution on a systemd host: resolvectl, resolv.conf, nsswitch and getent versus dig

Goal

Find why name resolution fails or gives different answers to different tools on a Linux host that runs systemd-resolved (the default on Ubuntu since 17.04 and on Fedora since 33; optional on Debian, and not the default on RHEL).

Prerequisites

resolvectl present (systemd-resolved package/unit); root not required for read-only queries.

Steps

1. Check whether resolved is actually managing resolution: resolvectl status. It lists the global DNS servers, the per-link servers and search domains, and the current DNSSEC/DNSOverTLS mode.
2. Look at /etc/resolv.conf. If it is a symlink to /run/systemd/resolve/stub-resolv.conf, applications that read it send queries to the local stub listener on 127.0.0.53:53, which resolved then forwards per link — the file does not show the real upstream servers. If it points to /run/systemd/resolve/resolv.conf instead, it lists the real upstream servers and applications reading it bypass resolved's per-link routing and cache.
3. Query through resolved and compare with a direct query: resolvectl query example.com versus dig @<real-upstream-server> example.com. A difference points at resolved's own cache, per-link server selection, or DNSSEC validation, not at the network path.
4. Check /etc/nsswitch.conf, the hosts: line. Its order decides who answers: files consults /etc/hosts (normally first), resolve asks resolved directly, dns uses the servers in /etc/resolv.conf, and modules such as myhostname or mdns4_minimal can answer before DNS is asked. getent hosts and every glibc getaddrinfo caller follow this order; dig talks to a DNS server directly and bypasses NSS and /etc/hosts entirely.
5. Run getent hosts example.com and getent ahosts example.com and compare with dig/resolvectl query. A getent answer that differs from dig usually means the hosts: order or an /etc/hosts entry, not DNS, decided the answer.
6. For a stuck cache, resolvectl flush-caches (root) clears resolved's cache without restarting the service.

Expected result

A clear statement of which layer produced which answer: resolved's cache, the stub listener, NSS ordering, or the authoritative DNS server itself.

Limits and test basis

Debian's default installation, unlike Ubuntu, commonly does not enable systemd-resolved; on such a host /etc/resolv.conf is a plain file and this procedure does not apply — check with readlink /etc/resolv.conf first. Commands verified against resolvectl(1), systemd-resolved.service(8) and nsswitch.conf(5).