> Source: [sk185210](https://support.checkpoint.com/results/sk/sk185210)

# sk185210 - DNS resolution failure in R81.20 Jumbo Hotfix Take 158

| Property | Value |
|----------|-------|
| Solution ID | sk185210 |
| Date Created | 2026-07-29 |
| Last Modified | 2026-08-03 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server |
| Versions | R81.20, R81.20 |
| OS | Gaia |

## Symptoms

- * DNS stops working after upgrading to R81.20 Jumbo Hotfix Take 158
* The `/etc/resolv.conf` file contains only the local loopback resolver (127.0.0.1).
* `nslookup` and `dig` commands times out when no DNS server is specified explicitly.
* Anti-Virus and Anti-Bot updates fail because the Security Gateway cannot resolve DNS names.
* Rebooting after changing the DNS configuration manually will cause the issue to resurface.
* The `dnsmasq` process is not running.
* `/var/log/messages*` from after the Jumbo Hotfix installation shows `"resolv_xlate: Starting resolv_xlate as per-vs mode"`.
* There is no `"resolv:mode"` entry in `/config/active`.

## Cause

The Jumbo Hotfix Accumulator Take introduced a change in DNS behavior.  

With this change, Gaia OS uses `dnsmasq` to cache and process local DNS requests.  
In this DNS mode, `/etc/resolv.conf` is expected to point to: `nameserver 127.0.0.1`  

The local `dnsmasq` process must then forward DNS queries to the configured DNS servers.  

On affected systems, the Gaia configuration database file `/config/active` does not contain this required parameter: resolv:mode default

This condition was linked to systems that were upgraded in-place from earlier releases (R80.40 and earlier). Because the `resolv:mode` parameter is missing, the DNS transition logic results in an incomplete DNS configuration.  
As a result, the `/etc/resolv.conf` file contains only `127.0.0.1`, but DNS forwarding through `dnsmasq` does not operate correctly.  
Locally initiated DNS resolution fails unless the command specifies a DNS server manually.

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 161

<br />

<br />

<br />

If you choose not to install the Hotfix, this **workaround** is available:

**On non-VSX Environments:**

1. Run these commands in Expert mode:
   1. `[Expert@gw8120:0]# dbset resolv:mode default`  
      `[Expert@gw8120:0]# dbset :save`  
      `[Expert@gw8120:0]# reboot`
2. Configure the DNS servers via Clish/WebUI if necessary.

**On VSX Environments:**

1. Run these commands in Clish (**Note:** For Scalable Platforms, use gClish):
   1. `clish> set dns mode default`  
      `clish> save config`
2. Configure the DNS servers via Clish if necessary.

**Notes:**

* This workaround can be applied before the Jumbo Hotfix Accumulator upgrade. If applied before the upgrade, no Hotfix is required for this issue.
* Do not manually edit `/config/active`. Use `dbset` as shown in the Solution section.
* Do not manually edit `/etc/resolv.conf` as a permanent fix. Gaia will rewrite this file automatically.
* A reboot causes traffic impact on a standalone Security Gateway. In a cluster, follow normal maintenance procedures and reboot only one Cluster Member at a time.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content