dns_failure: the target could not be resolved safely

Common causes

• A typo or a hostname that does not exist yet.
• A private or split-horizon name that only resolves inside your own network.
• A host that returns both public and private records — a common rebinding pattern.
• Authoritative servers answering differently between lookups.

How to fix it

1. 01Check the hostname resolves publicly: dig +short example.com from outside your network.
2. 02Use the publicly resolvable name for any call that goes through the relay.
3. 03Do not retry immediately; a resolution failure is usually configuration, not transient load.

What it looks like

# diagnose from a public resolver
dig +short api.example.com @1.1.1.1

# a mixture like this will be refused by the relay
# 93.184.216.34
# 10.0.4.19

Every error code