Cloudflare Tunnel · DNS · Help

cloudflared on Linux cannot resolve a .local origin

Check name resolution inside the connector environment when a .local service works on other devices.

Source date: 5 November 2026Editorial team: KAN KAI WORKSEditorially updated:

Quick answer

A .local name may resolve through multicast DNS on one device while remaining unresolved inside a Linux connector. The running process or container's resolver environment is decisive. Test the name there and compare it with a controlled direct connection. Reaching an IP address alone proves neither the correct HTTP host nor a matching TLS server name; certificate verification still matters.

Source basis: Q1 · Q2 · Q3

Applies to
Covers .local origin names on Linux. The cloudflared 2026.8.2 report compares resolver environments and does not establish a universal Linux or Go resolver defect.
How to verify the result
The actual connector resolves the intended name after a restart, and both direct application access and tunnel access work with correct host and TLS verification.
Your first check

Which resolver does the running connector use for the origin?

Compare resolution inside the service or container with your workstation. A working browser on another device does not verify this lookup path.

An internal service opens at device.local on your computer, but Cloudflare Tunnel returns an origin error. The connector log says no such host, sometimes naming a public DNS resolver. This difference appears in a reported Linux deployment. Successful access from macOS does not establish that the Linux process uses the same name-resolution mechanism. Q1

A local name is not automatically conventional DNS

Multicast DNS provides local-link resolution through a different mechanism from a query to an ordinary DNS server. Q2 The useful question is not whether the name works somewhere, but whether it resolves reliably in cloudflared's actual execution environment.

Compare the right environments

  1. Read the active service destination. Record the service URL's scheme, hostname and port. Check that the log error concerns that origin name rather than a hostname used to establish the Cloudflare connection itself.
  2. Identify the connector context. Establish whether cloudflared runs directly on Linux, inside Docker or as another isolated service. Inspect that environment's resolver configuration. A successful lookup on a Docker host is not automatically a successful lookup inside the container.
  3. Separate the name from the address. Obtain the current destination address through a trusted local administration path. Compare name resolution and connectivity. A successful TCP connection to the address with failed name resolution narrows the issue, but does not yet verify HTTP host selection or TLS identity.
  4. Choose a maintainable naming source. A stable internal DNS name may be easier to operate consistently than a workstation-specific discovery mechanism. A static host entry requires explicit ownership of address maintenance, particularly where DHCP can change the destination.
  5. Preserve host and certificate identity. If the connection name changes, check virtual-host routing, the expected certificate name and any applicable documented origin parameters. Cloudflare separates the service destination from some HTTP and TLS identity settings. Q3 Do not replace correct identity mapping with disabled certificate verification.

Verify the lasting result

Resolution should continue to work after a restart and from the actual connector context. Then compare a harmless request directly and through the tunnel, ensuring both reach the intended application. If addresses can change, establish how those changes will reach the chosen DNS or host mapping.

For support, prepare the service URL without credentials, connector launch method, resolver information and comparison results. Do not publish internal names or private addresses in public DNS merely to make a public resolver return something. The intended local naming design should determine the correction.

Frequently asked questions

Why can my laptop resolve the name?

It may use a local resolution mechanism that the container or background service does not share.

Can I replace the name with an IP address?

That can be a limited diagnostic comparison. Permanent operation also requires correct address maintenance, host selection and TLS name verification.

Describe your case

Support with this issue

We can review internal name resolution and the origin’s HTTP and TLS identity.

Describe your case →Related service: Data & improvements

Sources