← Back to Learning Hub

DNS • Intermediate • 5 min read

Flush DNS Cache on Linux: systemd-resolved, dnsmasq, and nscd

Flush DNS on Linux: find whether systemd-resolved, dnsmasq, or nscd is caching, then run the exact restart or flush command for Ubuntu, Debian, and RHEL here.

To flush the DNS cache on Linux, you first have to find out what is doing the caching, because Linux has no single built-in DNS cache. The answer is almost always one of three local services: systemd-resolved, dnsmasq, or nscd. Once you know which is running, the flush is a single command. On a modern systemd distribution it is sudo resolvectl flush-caches; with dnsmasq you restart the service; with nscd you invalidate the hosts cache. This guide shows how to detect your caching daemon and run the right command for Ubuntu, Debian, and RHEL-family systems.

Why Linux has no single flush command

Unlike Windows or macOS, a stock Linux system often does no DNS caching at all; every lookup goes straight to the configured resolver. Caching appears only when you run a local service that provides it. That is why advice like "just run one command" fails so often on Linux: the correct command depends entirely on which service is installed. Identify the service first, then flush it.

If you installed a service specifically to cache DNS, you already know the answer. On a default install, the most likely candidate is systemd-resolved, which ships enabled on recent Ubuntu and many other distributions.

Which caching service is running?

ServiceHow to detect itFlush command
systemd-resolvedsystemctl is-active systemd-resolved returns activesudo resolvectl flush-caches
dnsmasqsystemctl is-active dnsmasq returns activesudo systemctl restart dnsmasq
nscdsystemctl is-active nscd returns activesudo nscd -i hosts
None of the aboveAll three report inactiveNo local cache to flush; check your router or resolver

Run the three detection commands in order. The first one that returns active is your caching service. It is possible, though uncommon, to have more than one, so if you are troubleshooting aggressively, check all three.

Flush step by step

  1. Detect the service. Run the three systemctl is-active checks above to find which daemon is caching.
  2. Run the matching flush command. Use the command from the table that corresponds to your active service.
  3. Authenticate with sudo. Each command needs root privileges, so enter your password when prompted.
  4. Verify the flush. On systemd-resolved, run resolvectl statistics and confirm the current cache size dropped to zero.
  5. Test resolution. Query the affected name again and confirm the new value is returned.

Per-distribution notes

On Ubuntu 18.04 and later, systemd-resolved is the default, so sudo resolvectl flush-caches is almost always the right command. On older Ubuntu you may find the legacy systemd-resolve --flush-caches spelling instead. Debian ships systemd-resolved but it is not always enabled, so run the detection step rather than assuming. On RHEL, CentOS Stream, Rocky, and AlmaLinux, DNS caching frequently runs through dnsmasq or NetworkManager's dnsmasq plugin, in which case restarting the service clears the cache. If your RHEL system uses nscd for name service caching, use sudo nscd -i hosts to invalidate just the hosts database without restarting the whole daemon.

Confirming what the cache should contain

A flush only helps when the upstream answer has actually changed. Before assuming the cache is at fault, confirm the authoritative value with the Valla DNS lookup tool, which queries the real nameservers directly. If the authoritative answer still shows the old value, the problem is propagation, not your local cache. For low-level debugging on the host itself, the dig command cheat sheet lists the exact queries to compare cached and authoritative responses, and the combined flush DNS on Windows, Mac, and Linux guide covers the other platforms.

When nothing is caching

If all three services report inactive, your Linux host is not caching DNS, and flushing is not your fix. In that case the stale answer is coming from upstream: your router, a corporate resolver, or an application that caches internally. Browsers in particular keep their own DNS cache separate from the operating system, so restarting the browser can resolve a problem that no system flush will touch.

Frequently asked questions

How do I flush the DNS cache on Ubuntu?

Most Ubuntu systems use systemd-resolved, so run sudo resolvectl flush-caches. Confirm the service is active first with systemctl is-active systemd-resolved, then verify the flush with resolvectl statistics to see the cache size drop to zero.

Why is there no single flush DNS command for Linux?

Linux does not cache DNS by default. Caching comes from an optional local service such as systemd-resolved, dnsmasq, or nscd, and each uses a different command. You must identify which service is running before you can flush the right cache.

How do I flush DNS when dnsmasq is the resolver?

Restart the service with sudo systemctl restart dnsmasq. dnsmasq has no dedicated flush command, so restarting it is the supported way to clear its cache. The restart is brief and only affects local DNS resolution.

What command clears the nscd DNS cache?

Use sudo nscd -i hosts to invalidate the hosts database, which is where nscd caches DNS lookups. This clears only the name resolution cache without restarting the entire nscd daemon or touching its other caches.

I flushed the cache but the old record persists, why?

Either no local service was actually caching, or the stale answer comes from upstream. Check your router and resolver, restart your browser since it caches DNS separately, and confirm the authoritative record has truly changed with a direct lookup.

Want to be sure which value your resolver should return? Check it against the authoritative nameservers with the Valla DNS lookup tool.

Troubleshooting box

If results look inconsistent, compare authoritative nameservers first, then recursive resolvers by region. Capture snapshots every 10 minutes for deterministic incident timelines.

Try VallaDNS free →

Intermediate • 6 min

SSHFP Records: Pin SSH Host Keys in DNS

How SSHFP records publish SSH host-key fingerprints in DNS so clients verify a server on first connect, how to generate them, and why DNSSEC matters here.