New vServer (RS 2000 G12) - DNS resolution not working since delivery, 2 tickets opened, no response yet

    Hello everyone,

    I'm a new netcup customer and ran into a DNS issue on my newly provisioned vServer that I haven't been able to resolve, and unfortunately I haven't received any response on the two support tickets I've opened so far.

    Server details:
    Product: RS 2000 G12
    Provisioned on: June 24, 2026

    The problem:
    DNS resolution has not worked since the server was first delivered. General IP-level connectivity is completely fine, but any hostname lookup fails:

    ping -c 3 8.8.8.8
    → works perfectly, 0% packet loss

    ping -c 3 google.com
    → ping: google.com: Temporary failure in name resolution

    curl -v http://debian.anexia.at --max-time 10
    → Resolving timed out after 10000 milliseconds

    My /etc/resolv.conf contains the default nameservers assigned to this server (the standard netcup-assigned ones for my datacenter region). None of them appear to be responding.

    I also checked the SCP Firewall tab for this server — there are no DROP/block rules for port 53 or any DNS-related traffic. The only DROP rules are the default "netcup Mail Block" policy (SMTP/SMTPS/submission ports), and the implicit rules accept all other traffic. So this doesn't appear to be a firewall issue on my end.

    Because DNS doesn't work, I also can't install diagnostic tools (mtr-tiny, iperf3) via apt-get, since package installation also requires resolving the mirror hostname, so I wasn't able to attach the MTR/iperf3 output that support normally asks for.

    I've opened two tickets about this (over the past day) and haven't received any response on either. As a new customer this is a bit concerning — is there a typical response time I should expect, or is there something else I should be doing to get a ticket looked at? Has anyone else run into this exact "resolv.conf nameservers not responding on a fresh server" issue, and if so, how did you get it resolved?

    Any guidance would be appreciated — thank you!

    Çağrı

    ---

    Betreff: Neuer vServer (RS 2000 G12) - DNS-Auflösung funktioniert seit Lieferung nicht, 2 Tickets eröffnet, noch keine Antwort

    Hallo zusammen,

    ich bin ein neuer netcup-Kunde und bin auf ein DNS-Problem bei meinem neu bereitgestellten vServer gestoßen, das ich bisher nicht lösen konnte. Leider habe ich auf die beiden bisher eröffneten Support-Tickets noch keine Antwort erhalten.

    Server-Details:
    Produkt: RS 2000 G12
    Bereitgestellt am: 24. Juni 2026

    Das Problem:
    Die DNS-Auflösung funktioniert seit der ersten Lieferung des Servers nicht. Die allgemeine IP-Konnektivität ist vollkommen in Ordnung, aber jede Hostname-Auflösung schlägt fehl:

    ping -c 3 8.8.8.8
    → funktioniert einwandfrei, 0% Paketverlust

    ping -c 3 google.com
    → ping: google.com: Temporary failure in name resolution

    curl -v http://debian.anexia.at --max-time 10
    → Resolving timed out after 10000 milliseconds

    Meine /etc/resolv.conf enthält die für diesen Server zugewiesenen Standard-Nameserver (die üblichen netcup-Nameserver für meine Rechenzentrumsregion). Keiner davon scheint zu antworten.

    Ich habe auch den Firewall-Tab im SCP für diesen Server geprüft — es gibt keine DROP/Block-Regeln für Port 53 oder DNS-bezogenen Traffic. Die einzigen DROP-Regeln sind die Standard-"netcup Mail Block"-Policy (SMTP/SMTPS/Submission-Ports), und die impliziten Regeln akzeptieren allen übrigen Traffic. Es scheint also kein Firewall-Problem auf meiner Seite zu sein.

    Da DNS nicht funktioniert, kann ich auch keine Diagnosewerkzeuge (mtr-tiny, iperf3) über apt-get installieren, da die Paketinstallation ebenfalls die Auflösung des Mirror-Hostnamens erfordert. Daher konnte ich die MTR/iperf3-Ausgabe, die der Support normalerweise anfordert, nicht beilegen.

    Ich habe dazu zwei Tickets eröffnet (im Laufe des letzten Tages) und auf keines davon eine Antwort erhalten. Als neuer Kunde finde ich das etwas besorgniserregend — gibt es eine typische Reaktionszeit, die ich erwarten sollte, oder sollte ich noch etwas anderes tun, damit sich jemand das Ticket ansieht? Hatte schon jemand genau dieses Problem ("resolv.conf-Nameserver antworten auf einem frischen Server nicht") und falls ja, wie wurde es gelöst?

    Für jede Hilfe wäre ich sehr dankbar — vielen Dank!

    Çağrı

    Strange issue!

    As far as I can see, you already checked the relevant settings of the SCP firewall (however it should work out of the box).
    Which OS - Debian?
    Please show the current content of your resolv.conf.

    You might try to replace the netcup DNS-servers in your resolv.conf by e.g. 8.8.8.8.

    Check something like

    host 8.8.8.8 8.8.8.8

    or

    host 8.8.8.8 1.1.1.1

    If this works, network connectivity is fine. Then we have to check the resolv.conf in detail.

    If this does not work, we need to investigate the network.

    Which image did you install?

    | VPS: 28 | vCPU: 75 | Memory: 104 GB | Disk: 4012 GB |

    First of all welcome to the netcup forum and congratulations to this shiny new vServer. :)
    I will try and directly come to the problem described with the name resolution not working, but just two notes to the current support situation. There is already a disclaimer on the support page where you created your two tickets that there might be delays.

    netcup_EN_Support_delays.png

    And creating more tickets does not help in processing items in an overloaded system, so at the moment your best option is to ask for help on this forum for netcup customers helping other customers out.

    Coming to the problem at hand this host name resolution might be OS related and the first information missing is which OS did you provision the server with? :?: (not everyone customer here is familiar with all the provided OS flavours that are available)

    Quote from cgrkrt

    The problem:
    DNS resolution has not worked since the server was first delivered. General IP-level connectivity is completely fine, but any hostname lookup fails:

    (...)

    My /etc/resolv.conf contains the default nameservers assigned to this server (the standard netcup-assigned ones for my datacenter region). None of them appear to be responding.

    My seconds question would be which DNS resolvers you are using so basically what the content of your /etc/resolv.conf file looks like, so that someone can verify if these DNS servers are working and responsive. :?:

    The first step that I would take without consulting any artificial intelligence is to correctly configure working servers in your resolver configuration files, if the default ones are not working. Have you tried that and what was the result?

    (As you already stated netcup per default just blocks outgoing Mail / SMTP traffic on the default ports, because most of the damaged reputation of the net block stems from misconfigured vServers and such. As mentioned this should not affect any DNS resolver queries and the firewall or specific rules can also be turned off if needed.)

    In case you figure out which netcup provided nameservers are not working and which OS setup is affected, please let us know and then also netcup would probably appreciate if you tell them exactly what you found.

    WH1000 SE OST22 OST23 OST24 | WH1000 SE ADV25 | WH 🥚🧶🥛🐖 | 🦆 VPS 200 🇺🇦🕊️

    Contents of your /etc/resolv.conf are of interest of course, so we can check the DNS resolvers configured on your server. Also, to which data center does your server belong? NUE? VIE? MNZ?

    You could also try to use public resolvers from e.g. Google, Cloudflare etc. in your /etc/resolv.conf as a fast solution. You can change the resolvers again later on, but it should help with the name resolving problem you are currently facing. It should also allow you to install whatever software you need to investigate the problem with netcup resolvers.

    Update: the issue appears to have resolved itself.

    Thank you all for the responses, answering everyone's questions for the record:

    OS: Debian 13 (trixie) - minimal, netcup's default install image.
    Data center: Nuremberg (NUE).
    /etc/resolv.conf was never modified by me and still contains the original netcup-assigned nameservers:
    nameserver 46.38.252.230
    nameserver 46.38.225.230
    nameserver 2a03:4000:0:1::e1e6

    Firewall: confirmed no DROP rules for port 53, just the default "netcup Mail Block" (SMTP ports) and implicit accept-all otherwise.

    However, just now when I re-tested (about 2 days after the server was provisioned), DNS resolution is working again, without me changing anything:

    ping google.com -> resolves and replies normally (0% packet loss)
    curl http://debian.anexia.at -> resolves and returns HTTP 200 normally

    So it looks like the netcup-provided nameservers simply weren't responding for a while after initial provisioning, and started working on their own after roughly 1-2 days, with the resolv.conf untouched the whole time. I never had to switch to public resolvers.

    Posting this in case it helps others who hit the same "fresh server, DNS not working, IP connectivity fine" symptom - it may just need some time after provisioning for netcup's nameservers to become responsive for the new IP. Will still mention this in my support ticket for visibility, but wanted to update the thread here too. Thanks again for all the help debugging this!

    Yeah same here,btw your server ip starts with 159...? I changed default dns to 1.1.1.1 & 8.8.8.8 in resolv.conf so it's working now. Support requested some tests but not answering my emails anymore,email support is awful here. Maybe i'll try calling them

    P.S. They replied, said DNS issue is resolved, so that's why default DNS must be working now.

    Quote from ehrmantraut_mike

    Yeah same here,btw your server ip starts with 159...? I changed default dns to 1.1.1.1 & 8.8.8.8 in resolv.conf so it's working now. Support requested some tests but not answering my emails anymore,email support is awful here. Maybe i'll try calling them

    P.S. They replied, said DNS issue is resolved, so that's why default DNS must be working now.

    Let's hope so. It's just not exactly the first time that those resolvers made trouble. And this hasn't always been as bad and obvious as in your case. So let's hope this was the final fix after years of occasional, intermittent problems.

    Anyway, good to have your server working now.

    Edited once, last by tab (June 26, 2026 at 3:21 PM).

    Keep in mind: the SCP firewall is stateless for UDP. For DNS servers other than the Netcup servers to work, you need to set up this rule:

    image.png

    Same for NTP (time sync) btw.

    RS 2000 G12 Pro BW25 (8C EPYC 9645, 16GB, 1TB) | RS 500 G12 BW25 (2C EPYC 9645, 4GB, 128GB) | RS Cyber Quack (1C,2GB,40GB)

    Edited once, last by TBT (June 26, 2026 at 5:03 PM).

    Quote from panthernet

    Having the similar problem with DNS on Win2025 VPS. DNS just do not work, nor google, nor netcup until I switch off firewall.
    I have following rules
    image.png

    What am I missing?

    The Netcup firewall is truly stateless when it comes to UDP traffic. Here is an example how a proper outbound DNS firewall rule should look like. Replace the DNS server's ip address with the one of your choice (in the screenshot below I use DNS4EU 86.54.11.13, 86.54.11.213).

    image.png

    Same goes for outbound NTP which is also UDP:

    image.png

    Assuming the following default policy, make sure to allow ICMP otherwise you'll break IPv6.

    image.png

    There are only 10 types of people in the world: those who understand binary, and those who don't.

    Edited 2 times, last by ckd (June 26, 2026 at 11:15 PM).

    Quote from ckd

    Here is an example how a proper outbound DNS firewall rule should look like. Replace the DNS server's ip address with the one of your choice (in the screenshot below I use DNS4EU 86.54.11.13, 86.54.11.213).

    image.png

    Hmm, warum benötigst Du so viele Regeln?
    Regel 6 sollte für Anfragen genügen und Regel 9 für die Antworten. Mehr habe ich bei mir auch nicht (außer noch eine ausgehende Regel für TCP Port 53).
    Bei Regel 4 und 5 ist z. B. Deine Server-IP-Adresse als Quelle definiert. Das kann bei eingehendem Traffic aus dem Internet aber ja nicht der Fall sein. Umgekehrt können die IP-Adressen der DNS-Resolver keine Quell-Adressen für ausgehenden Traffic ins Internet sein (Regeln 10 und 11).

    [Suche] RS Piccolo gesucht