When systemd-resolved Picks the Wrong DNS Server

In a previous post , I described how I built a DNS forwarder for qcontroller — a tool that manages QEMU VM instances. The forwarder watches the host's resolv.conf for changes and propagates upstream DNS servers to VMs transparently. It worked great — until I noticed that VMs occasionally failed to resolve private hostnames defined in the host's /etc/hosts . The Symptom The setup was straightforward. Inside each VM, DHCP advertised three DNS servers: the gateway IP (pointing to the forwarder) plus 8.8.8.8 and 1.1.1.1 as fallbacks. From the host, querying the forwarder directly worked fine: $ dig @192.168.71.1 myserver.internal.corp ; ; ANSWER SECTION: myserver.internal.corp. 0 IN A 10.0.50.42 But from inside a VM: $ dig myserver.internal.corp ; ; ->>HEADER <<- opcode : QUERY, status: NXDOMAIN ; ; SERVER: 127.0.0.53#53(127.0.0.53) (UDP) NXDOMAIN . The VM's systemd-resolved returned a negative answer — even though the forwarder had the correct one. What was going on? systemd-resolved Trea