> Source: [sk184587](https://support.checkpoint.com/results/sk/sk184587)

# sk184587 - DNS Resolution Failure in VS0 with Per-VS DNS Mode on VSNext R82

| Property | Value |
|----------|-------|
| Solution ID | sk184587 |
| Date Created | 2026-06-24 |
| Last Modified | 2026-07-06 |
| Technical Level | General |
| Products | Scalable Platforms |
| Versions | R82 |
| OS | Gaia |

## Symptoms

- * When DNS mode is configured as per?virtual system (per?VS) on VSNext R82 ElasticXL, DNS resolution may fail in VS0.
* DNS lookups fail in the affected Virtual System. The following command:  
  `nslookup example.com`  
  Returns the output:  
  `;; connection timed out; no servers could be reached`  
* Changing the DNS mode to the default configuration immediately restores DNS resolution.
* The `dnsmasq` process for any VS does not bind to the correct port range. To confirm, run the following commands in Expert mode:  
  To verify the configured range, run:  
  `[Expert]# cat /proc/sys/net/ipv4/ip_local_port_range`  
  To verify the currently bound dnsmasq ports, run:  
  `[Expert]# netstat -tulpn | grep dnsmasq_vs`  
  If the dnsmasq ports are outside the configured local port range, the issue is likely present.

## Cause

The issue occurs when the `query-port=0` directive is missing from the `dnsmasq` configuration file *$CPDIR/dns/dnsmasq.conf* on VSNext R82 ElasticXL systems configured to use per?VS DNS mode. Under this condition, `dnsmasq` may bind to source ports outside the expected local port range, which can prevent DNS queries from being processed correctly and result in DNS resolution failures in VS0.

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member / Security Group involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

If you do not wish to install a hotfix, then a **workaround** is available.

**Important:** This workaround does not survive a reboot or upgrade. Install the Hotfix for a permanent solution.  

Perform the following steps on the affected Security Gateway:

1. Enter Expert mode
2. Switch to the VS0 context. Run:  
   `vsenv 0`
3. Edit the file *$CPDIR/dns/dnsmasq.conf*
4. Verify that the following line exists:  
   `query-port=0`
5. If the line is missing, add it.
6. Save the file.
7. Restart the `dnsmasq` process for VS0 using Process Manager (pm). Run:  
   `tellpm process:dnsmasq_vs<id>`  
   `tellpm process:dnsmasq_vs<id> t`
8. Confirm that the `dnsmasq` process returns to the running state. Run:  
   `ps aux | grep -i dnsmasq`
9. Validate the DNS solution. From VS0, run:  
   `nslookup example.com`
10. Check that the logs do not show `Address already in use` or `FAILED to start up`.

<!-- -->

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content