# DNS trouble on debian

**URL:** <https://forums.screenly.io/t/dns-trouble-on-debian/6776>\
**Category:** Anthias\
**Created:** [September 28, 2026, 6:49pm UTC](https://forums.screenly.io/t/dns-trouble-on-debian/6776 "2026-09-28T18:49:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tommyxyz](https://avatars.discourse-cdn.com/v4/letter/t/9d8465/32.png) [@tommyxyz](https://forums.screenly.io/u/tommyxyz)\
**Post date:** [September 28, 2026, 6:49pm UTC](https://forums.screenly.io/t/dns-trouble-on-debian/6776/1 "2026-09-28T18:49:09Z")

</div>

Hi,  
I am having trouble with a setup on debian 13.

I installed debian as instructed and configured it as described. Everything worked fine, until I started the setup script for anthias to install [v2026.09.0](https://github.com/Screenly/Anthias/tree/v2026.09.0).

It always crashes out as follows:

```auto
TASK [system : Ensure a stable local DNS resolver before Docker starts (x86)] **************************************************************
included: /home/info/anthias/ansible/roles/system/tasks/dns.yml for localhost

TASK [system : Install systemd-resolved] ***************************************************************************************************
changed: [localhost]

TASK [system : Enable and start systemd-resolved] ******************************************************************************************
ok: [localhost]

TASK [system : Point /etc/resolv.conf at the systemd-resolved stub] ************************************************************************
changed: [localhost]

TASK [system : Install and configure Docker] ***********************************************************************************************
included: /home/info/anthias/ansible/roles/system/tasks/docker.yml for localhost

TASK [system : Create keyrings directory] **************************************************************************************************
ok: [localhost]

TASK [system : Check for existing Docker apt key] ******************************************************************************************
ok: [localhost]

TASK [system : Add Docker apt key] *********************************************************************************************************
[ERROR]: Task failed: Module failed: Request failed: <urlopen error [Errno -3] Temporärer Fehler bei der Namensauflösung>
Origin: /home/info/anthias/ansible/roles/system/tasks/docker.yml:22:3

20 register: system_docker_apt_key
21
22 - name: Add Docker apt key
     ^ column 3

fatal: [localhost]: FAILED! => {"changed": false, "dest": "/etc/apt/keyrings/docker.asc", "elapsed": 0, "msg": "Request failed: <urlopen error [Errno -3] Temporärer Fehler bei der Namensauflösung>", "url": "https://download.docker.com/linux/debian/gpg"}

PLAY RECAP *********************************************************************************************************************************
localhost : ok=19 changed=4 unreachable=0 failed=1 skipped=6 rescued=0 ignored=0   

```

If I try nslookup I get the following error:

```auto
info@infoscreen:~$ nslookup google.com
Server: 127.0.0.53
Address:	127.0.0.53#53

** server can't find google.com: REFUSED

```

I can get the setup to go through if I restart the pc.

Anthias then works for about 10 minutes and then stops displaying web content because the DNS doesnt work anymore (same result with nslookup as above).

I tried installing debian 12, the setup script crashes in the same way as with debian 13.

Does the setup script mess with the DNS config of Debian?

It also doesn’t make a difference whether i allow anthias to manage my network during the install or not.

How do I get this to work properly?

Update:

I installed v2026.8.2 on debian 13 to see if it is depending on the version used.

At first everything worked for a few minutes, then it stopped displaying some web assets, but still had a working dns according to nslookup.

But the debug logs of the viewer still show that the assets are not reachable:

```auto
anthias-viewer-1 | get_next_asset
anthias-viewer-1 | refresh_playlist
anthias-viewer-1 | refresh: counter: (0) deadline (2026-10-28 19:52:54.167959+00:00) timecur (2026-09-28 20:11:41.069765+00:00)
anthias-viewer-1 | get_next_asset after refresh
anthias-viewer-1 | get_next_asset counter 0 returning asset 1 of 3
anthias-viewer-1 | Asset Capital Quiz at https://capitals.srly.io/ is not available, skipping. Will stay quiet about this one until a different asset is unavailable.
anthias-viewer-1 | Starting new HTTP connection (1): anthias-server:8080
anthias-viewer-1 | <Command '/usr/local/bin/AnthiasViewer'>.<Process 97 ['/usr/local/bin/AnthiasViewer']>.stdin: received no data
anthias-viewer-1 | <Command '/usr/local/bin/AnthiasViewer'>.<Process 97 ['/usr/local/bin/AnthiasViewer']>: <sh.StreamWriter object at 0x7f98f7a6bcb0> ready for more input
anthias-viewer-1 | http://anthias-server:8080 "POST /api/v2/assets/d2db06a84020489a8cd36efec2e4a3f8/recheck HTTP/1.1" 202 0
anthias-viewer-1 | <Command '/usr/local/bin/AnthiasViewer'>.<Process 97 ['/usr/local/bin/AnthiasViewer']>.stdin: received no data
anthias-viewer-1 | <Command '/usr/local/bin/AnthiasViewer'>.<Process 97 ['/usr/local/bin/AnthiasViewer']>: <sh.StreamWriter object at 0x7f98f7a6bcb0> ready for more input
anthias-viewer-1 | <Command '/usr/local/bin/AnthiasViewer'>.<Process 97 ['/usr/local/bin/AnthiasViewer']>.stdin: received no data
anthias-viewer-1 | <Command '/usr/local/bin/AnthiasViewer'>.<Process 97 ['/usr/local/bin/AnthiasViewer']>: <sh.StreamWriter object at 0x7f98f7a6bcb0> ready for more input
anthias-viewer-1 | <Command '/usr/local/bin/AnthiasViewer'>.<Process 97 ['/usr/local/bin/AnthiasViewer']>.stdin: received no data
anthias-viewer-1 | <Command '/usr/local/bin/AnthiasViewer'>.<Process 97 ['/usr/local/bin/AnthiasViewer']>: <sh.StreamWriter object at 0x7f98f7a6bcb0> ready for more input
anthias-viewer-1 | <Command '/usr/local/bin/AnthiasViewer'>.<Process 97 ['/usr/local/bin/AnthiasViewer']>.stdin: received no data
anthias-viewer-1 | <Command '/usr/local/bin/AnthiasViewer'>.<Process 97 ['/usr/local/bin/AnthiasViewer']>: <sh.StreamWriter object at 0x7f98f7a6bcb0> ready for more input
anthias-viewer-1 | <Command '/usr/local/bin/AnthiasViewer'>.<Process 97 ['/usr/local/bin/AnthiasViewer']>.stdin: received no data
anthias-viewer-1 | <Command '/usr/local/bin/AnthiasViewer'>.<Process 97 ['/usr/local/bin/AnthiasViewer']>: <sh.StreamWriter object at 0x7f98f7a6bcb0> ready for more input
anthias-viewer-1 | get_next_asset
anthias-viewer-1 | refresh_playlist
anthias-viewer-1 | refresh: counter: (0) deadline (2026-10-28 19:52:54.167959+00:00) timecur (2026-09-28 20:11:41.602343+00:00)
anthias-viewer-1 | get_next_asset after refresh
anthias-viewer-1 | get_next_asset counter 0 returning asset 2 of 3
anthias-viewer-1 | Asset Word of the Day at https://word.srly.io/ is not available, skipping. Will stay quiet about this one until a different asset is unavailable.

```

after a while dns just dies completely again:

```auto
info@infoscreen:~/anthias$ ping google.com
ping: google.com: Temporary failure in name resolution
info@infoscreen:~/anthias$ nslookup google.com
Server: 127.0.0.53
Address:	127.0.0.53#53

** server can't find google.com: REFUSED

info@infoscreen:~/anthias$ 

```

then, after a reboot it just works again, displays all of the web assets, until dns just dies again.

```auto
info@infoscreen:~$ nslookup google.com
Server: 127.0.0.53
Address:	127.0.0.53#53

Non-authoritative answer:
Name:	google.com
Address: 142.251.110.138
Name:	google.com
Address: 142.251.110.102
Name:	google.com
Address: 142.251.110.113
Name:	google.com
Address: 142.251.110.100
Name:	google.com
Address: 142.251.110.139
Name:	google.com
Address: 142.251.110.101
Name:	google.com
Address: 2a00:1450:4001:c1f::66
Name:	google.com
Address: 2a00:1450:4001:c1f::65
Name:	google.com
Address: 2a00:1450:4001:c1f::71
Name:	google.com
Address: 2a00:1450:4001:c1f::64

```

7 Minutes later without touching anything:

```auto
info@infoscreen:~$ nslookup google.com
Server: 127.0.0.53
Address:	127.0.0.53#53

** server can't find google.com: REFUSED

```

So the behaviour is almost identical to that with the newer version.

---

<div class="post-metadata">

**Author:** ![vpetersson-bot](https://yyz1.discourse-cdn.com/flex029/user_avatar/forums.screenly.io/vpetersson-bot/32/803_2.png) [@vpetersson-bot](https://forums.screenly.io/u/vpetersson-bot)\
**Post date:** [October 21, 2026, 10:53am UTC](https://forums.screenly.io/t/dns-trouble-on-debian/6776/2 "2026-10-21T10:53:03Z")

</div>

This is a bug on our side, not your setup — thanks for the detailed write-up, it was enough to reproduce the failure exactly on our own x86 test machine.

**What’s happening**

Our installer switches x86 hosts over to `systemd-resolved` and repoints `/etc/resolv.conf` at its stub resolver. On a stock Debian netinst your NIC is brought up by ifupdown with **dhcpcd** as the DHCP client, and dhcpcd can only hand its nameservers to `systemd-resolved` through a helper that ships _with the `systemd-resolved` package itself_. So at the moment the installer swaps that file, resolved has no upstream server configured at all and answers every query `REFUSED` — which is exactly the `Temporary failure in name resolution` you got on “Add Docker apt key”, and exactly what your `nslookup` shows.

After a reboot dhcpcd does publish its nameservers (the helper now exists), so things work. It then stops because of how that helper talks to resolved: dhcpcd publishes separate record sets for IPv4 and for IPv6 router advertisements, and when any one of them is withdrawn it takes the **whole link’s** DNS with it — back to `REFUSED` until the next reboot. That’s your 10-minute window.

**Getting you running now**

Give resolved a fallback nameserver. Substitute your router’s IP, and your interface name if it isn’t `enp2s0` (check with `ip -br link`):

```auto
sudo mkdir -p /etc/systemd/resolved.conf.d
printf '[Resolve]\nFallbackDNS=192.168.178.1\n' | sudo tee /etc/systemd/resolved.conf.d/99-fallback.conf
sudo systemctl restart systemd-resolved
sudo dhcpcd -n enp2s0

```

That survives reboots and covers both failures — a fallback is consulted whenever the link has no servers of its own, so it closes the install-time gap _and_ the later wipe. Verified on our test machine.

If you’d rather get through the installer first, run those three `sudo` lines before re-running the install script and it won’t trip on the Docker key step.

We’ll ship the equivalent in the installer so a fresh install doesn’t need any of this.

---

<div class="post-metadata">

**Author:** ![vpetersson-bot](https://yyz1.discourse-cdn.com/flex029/user_avatar/forums.screenly.io/vpetersson-bot/32/803_2.png) [@vpetersson-bot](https://forums.screenly.io/u/vpetersson-bot)\
**Post date:** [October 22, 2026, 7:21am UTC](https://forums.screenly.io/t/dns-trouble-on-debian/6776/3 "2026-10-22T07:21:29Z")

</div>

Just to close the loop: the fix for this is now written and waiting to be merged.

- [The report](https://github.com/Screenly/Anthias/issues/3408)
- [The fix](https://github.com/Screenly/Anthias/pull/3409)

It does automatically what you had to do by hand. Before the installer changes the way the machine looks up addresses, it now makes a note of the name servers that are already working and keeps them as a backup. That covers both of the problems you ran into: the one that stopped the install, and the one that came back about ten minutes after a reboot.

Once this is released, a fresh install on Debian will not need any of it.

There is nothing you need to change on your own machine. What you added by hand still works and will not clash with the update.

Thanks again for such a clear report. The part where you showed the lookup being refused was what made this quick to track down.