How nsswitch.conf Works in Linux Name Resolution

The /etc/nsswitch.conf (Name Service Switch configuration) file serves as the central switchboard for system databases in the Linux operating system, dictating the exact sequence and sources used to resolve essential system information such as hostnames, user accounts, and network protocols. By configuring this file, administrators control whether the system queries local files, domain name servers (DNS), or network directories like LDAP first when looking up an address or identity. This article explains the mechanics of nsswitch.conf, specifically detailing its role, syntax, and operational logic in controlling Linux hostname resolution.

The Role of the Name Service Switch

In Linux, applications rely on standard C library (glibc) routines—such as gethostbyname() or getaddrinfo()—to convert human-readable hostnames into IP addresses. Instead of hardcoding where these lookup routines search, the system uses the Name Service Switch facility. The /etc/nsswitch.conf file provides the modular configuration for this mechanism, decoupling the lookup process from static system files and allowing administrators to seamlessly integrate local configurations with external network services.

The hosts Database Entry

While nsswitch.conf controls lookups for various databases including passwd, group, and shadow, name resolution is specifically governed by the hosts: directive.

A standard hosts: line typically looks like this:

hosts: files dns

The system processes sources listed after the colon strictly from left to right:

1. files: Directs the operating system to query the local /etc/hosts file first.
2. dns: Instructs the system to query external Domain Name System (DNS) servers if the local file does not yield a match.

Common Resolution Sources

Linux supports multiple backend modules for the hosts database, represented as shared libraries in /lib/ or /usr/lib/ (e.g., libnss_files.so, libnss_dns.so):

• files: Reads directly from /etc/hosts.
• dns: Queries the nameservers specified in /etc/resolv.conf.
• myhostname: Automatically provides local resolution for the system's own hostname and localhost without needing an entry in /etc/hosts.
• mdns_minimal / mdns4_minimal: Resolves multicast DNS (.local) addresses using Avahi.
• ldap: Queries an external Lightweight Directory Access Protocol directory service.

Conditional Actions and Search Control

By default, the name resolution process queries the first source. If that source returns a successful match (SUCCESS), the search stops and returns the result. If the source returns NOTFOUND, execution automatically moves to the next source in the list.

Administrators can override this default behavior using status criteria enclosed in square brackets:

hosts: files [NOTFOUND=return] dns

The available statuses include:

• SUCCESS: The requested entry was found.
• NOTFOUND: The source was accessed successfully, but the requested entry does not exist.
• UNAVAIL: The source is unreachable or not configured.
• TRYAGAIN: The source is busy or temporarily unavailable.

The available actions are:

• continue: Proceed to the next source in the list (the default behavior for NOTFOUND, UNAVAIL, and TRYAGAIN).
• return: Stop searching immediately and return the current status to the calling application.

In the example files [NOTFOUND=return] dns, if a hostname is missing from /etc/hosts, the lookup halts immediately instead of querying DNS, preventing fallback resolution.

The Relationship Between nsswitch.conf and resolv.conf

It is common to confuse /etc/nsswitch.conf with /etc/resolv.conf. They perform two distinct functions in the resolution pipeline:

• /etc/nsswitch.conf determines the lookup order (e.g., check local files first, then query DNS).
• /etc/resolv.conf determines how to query DNS (defining the specific IP addresses of upstream nameservers, search domains, and query timeouts).

The system only reads /etc/resolv.conf when nsswitch.conf directs the resolution request to the dns service.