How to flush the DNS cache on Linux

To flush the DNS cache on Linux, run sudo resolvectl flush-caches. That covers Ubuntu, Fedora, Linux Mint and every other distribution that uses systemd-resolved. If your system runs dnsmasq, nscd, BIND or Unbound instead, each has its own command, and many servers have no DNS cache to flush at all.

The reason is simple: Linux itself does not cache DNS. A lookup goes to whatever resolver /etc/resolv.conf names, and any caching happens in a separate service that your distribution may or may not run. So the first step is finding out which service that is. After that, the flush is one command. For other systems, see the overview for every device.

Find out which DNS cache you have

Two quick checks answer the question. First, look at where lookups are sent:

$ cat /etc/resolv.conf

• nameserver 127.0.0.53: systemd-resolved is in charge.
• nameserver 127.0.0.1 or ::1: a caching DNS service runs on this machine, typically dnsmasq, Unbound or BIND.
• Any other address (your router, such as 192.168.1.1, or a public resolver like 1.1.1.1): lookups go straight out. Unless nscd is running, there is no local cache to flush.

Then ask systemd which of the usual candidates is running:

$ systemctl is-active systemd-resolved dnsmasq nscd unbound named

It prints one line per service, in that order. Every service that reports active has a cache worth flushing. (On older Debian and Ubuntu releases the BIND service is called bind9 rather than named.)

For orientation, these are the defaults of a fresh install:

Whoever set the machine up may have added a cache later, which is why the two checks above beat any table.

Flush systemd-resolved (Ubuntu, Fedora, Linux Mint)

On Ubuntu, Fedora, Linux Mint and everything else that ships systemd-resolved:

$ sudo resolvectl flush-caches

There is no output. To confirm, look at the statistics:

$ resolvectl statistics

The line Current Cache Size should read 0. Run the command again a little later and you will see the number climb as the system looks names up again.

Use sudo. Older releases let any user flush the cache, but current systemd versions may ask for authorization, and with sudo the command behaves the same everywhere.

On Ubuntu 18.04 and 20.04 the tool still went by its old name:

$ sudo systemd-resolve --flush-caches

That name is gone from current releases. If you see systemd-resolve: command not found, use resolvectl.

Good to know: systemd-resolved empties its caches by itself whenever the network configuration changes, for example when you reconnect to Wi-Fi or plug in a cable. The systemd documentation says as much, and it is why you rarely need the command on a laptop.

Flush dnsmasq

dnsmasq is a small DNS and DHCP server found on routers, on Raspberry Pi setups and wherever NetworkManager is configured with dns=dnsmasq. Sending it a hang-up signal clears the cache without interrupting service:

$ sudo killall -HUP dnsmasq

The signal also makes dnsmasq read /etc/hosts again. A full restart does the same job if you prefer: sudo systemctl restart dnsmasq.

Flush nscd

The Name Service Cache Daemon comes from glibc and still turns up on older RHEL, CentOS and SUSE systems. It caches several databases, and hosts is the DNS one:

$ sudo nscd -i hosts

sudo systemctl restart nscd works as well. Newer distributions have dropped nscd, so do not worry if the command does not exist on your machine.

Flush BIND and Unbound

If the machine is itself a DNS server, flush the server's cache with its control tool:

• BIND: sudo rndc flush clears everything. sudo rndc flushname example.com removes a single name.
• Unbound: sudo unbound-control flush example.com removes a single name. sudo unbound-control reload reloads the server and drops the whole cache.

Nothing running? Then there is nothing to flush

On a default Debian, Arch or RHEL system none of these services is active. Each program asks the DNS server from /etc/resolv.conf directly and keeps nothing. If such a machine gets an outdated answer, the old record sits upstream: in your router, or at your provider's or a public resolver. Restart the router, or see router and public resolver caches for ways to clear those.

Check that the flush worked

Ask the same question twice and watch the timing:

$ dig example.com

Near the bottom, Query time shows how long the answer took. A cached answer comes back in 0 or 1 msec. The first lookup after a flush takes noticeably longer, because it has to go out to the network. To see what the outside world currently says, bypass your local setup and ask a public resolver directly:

$ dig @1.1.1.1 example.com +short

If that shows the new address while the plain dig still shows the old one, a local cache has not been cleared yet. If both show the old one, the change has not reached the resolvers and you can only wait for the TTL to run out. Our DNS lookup shows the record and its TTL without a terminal.

dig is part of the dnsutils (or bind9-dnsutils) package on Debian and Ubuntu and of bind-utils on Fedora and RHEL. With systemd-resolved you can use resolvectl query example.com instead.

Firefox and Chrome keep their own cache

Browsers on Linux cache DNS answers internally, exactly as on other systems. In Firefox, open about:networking#dns and click Clear DNS Cache. In Chrome and Chromium, open chrome://net-internals/#dns and click Clear host cache. More detail is in the browser section of the overview.

Errors and special cases

"Failed to flush caches: Unit dbus-org.freedesktop.resolve1.service not found." systemd-resolved is not running, so it has no cache. Go back to the two checks at the top to see what your system uses.

"systemd-resolve: command not found." The command was renamed. Use sudo resolvectl flush-caches.

Changes to /etc/hosts are ignored. On a system without a cache, the file is read on every lookup and changes apply immediately. systemd-resolved notices edits on its own. dnsmasq does not: send it the HUP signal shown above.

Programs with their own cache. Browsers, Java applications and some long-running daemons remember addresses internally. A system flush does not reach them, so restart the program in question.

Containers. A container brings its own resolver configuration and does not use the host's cache. If one holds on to an old address, restart the container or the application inside it.

Related guides

• Flush your DNS cache on any device (hub)
• How to flush the DNS cache on Windows
• How to flush the DNS cache on a Mac
• How to find your IP address on Linux
• DNS lookup: check any record and its TTL
• DNS speed test: find your fastest resolver