For AI agents: The documentation index is at https://docs.digitalocean.com/llms.txt. Markdown versions of pages use the same URL with index.html.md in place of the HTML page (for example, append index.html.md to the directory path instead of opening the HTML document).

DigitalOcean VPC networks provide an internal DNS resolver on the second-to-last IP address of the network. Configure your Droplets to use the internal resolver for better DNS performance and reliability on your DigitalOcean VPC network. This is especially important when using a NAT gateway, where multiple backend Droplets appear as one client to our DNS infrastructure and may be rate limited.

To update your Droplets to use the internal DNS resolver, find the IP address of your resolver, then update your Droplet’s DNS resolution configuration to use the new IP address.

Find a VPC Network’s Internal Resolver IP Address

A VPC network’s internal resolver IP address is always the second-to-last IP address of the network. To retrieve this IP address, use the DigitalOcean API or calculate it based on VPC network information shown in the control panel.

Use the Control Panel to Find a VPC Network’s Internal Resolver IP Address

Go to the VPC tab in the control panel and note the value shown in the IP Range column for your VPC network. It is an IPv4 address and network size is in CIDR format, like 10.116.0.0/20.

Next, open to the ARIN CIDR Calculator. In the Convert to IP Address Range section, enter the following:

• Prefix: The prefix is the IP address before the / slash.

• Prefix Length: The length is the number after the slash.

In the previous CIDR example, the prefix is 10.116.0.0 and the prefix length is 20.

Next, click Convert. You can view the end IP address in End IP Address. Your resolver IP address is the end IP address, minus 1 from the last octet. For example, if your end IP is 10.136.255.255, your resolver IP address is 10.136.255.254.

Use the resolver IP address in the next step to reconfigure your Droplet.

Use the DigitalOcean API to Find a VPC Network’s Internal Resolver IP Address

Send a GET request to the /v2/vpcs endpoint to list all of your team’s VPC networks. The following command pipes the API’s JSON response to jq which outputs only the VPC network name and resolver IP address:

curl -X GET \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
    "https://api.digitalocean.com/v2/vpcs" \
    | jq -r '.vpcs[] | "\(.name):\t\(.resolver_ip)"'

Add a valid DigitalOcean API token to the environment variable $DIGITALOCEAN_TOKEN before running the command.

The output is a list of VPC names and resolver IP addresses:

default-nyc2:	10.100.15.254
default-sgp1:	10.104.15.254
default-sfo3:	10.124.15.254

Find the resolver IP address for your VPC network and use it in the next step to reconfigure your Droplet.

Calculate the Resolver IP from a Droplet’s Private IP

If you are logged in to a Droplet on the VPC network, you can calculate the resolver IP directly from the Droplet’s private interface address:

PRIVATE_IP=$(ip -4 -o addr show eth1 | awk '{print $4}' | cut -d/ -f1)
VPC_RESOLVER_IP=$(python3 -c "
import ipaddress
net = ipaddress.ip_network('${PRIVATE_IP}/20', strict=False)
print(net.broadcast_address - 1)
")
echo "VPC resolver IP: $VPC_RESOLVER_IP"

The output shows the resolver IP for your VPC network:

VPC resolver IP: 10.116.15.254

Use the resolver IP address in the next step to reconfigure your Droplet.

Update Droplets to Use the VPC-local DNS Resolver

Update your Droplet’s networking configuration to use the VPC-local DNS resolver as the only resolver. After completing these steps, all DNS queries from the Droplet route exclusively through the VPC-local resolver. This configuration procedure varies between different Linux distributions.

sudo nano /etc/systemd/resolved.conf.d/DigitalOcean.conf

[Resolve]
DNS=<your-resolver-ip>

sudo systemctl restart systemd-resolved

sudo nano /etc/netplan/50-cloud-init.yaml

network:
  version: 2
  ethernets:
    eth0:
      match:
        macaddress: "ce:68:83:13:e9:dd"
      addresses:
      - "159.203.129.109/20"
      - "10.17.0.6/16"
      set-name: "eth0"
      mtu: 1500
      routes:
      - to: "0.0.0.0/0"
        via: "159.203.128.1"
    eth1:
      match:
        macaddress: "ea:a8:49:d0:7c:09"
      addresses:
      - "10.132.1.108/16"
      nameservers:
        addresses:
        - <your-resolver-ip>
      set-name: "eth1"
      mtu: 1500

sudo netplan apply

resolvectl status

Link 3 (eth1)
         Protocols: +DefaultRoute ...
  Current DNS Server: <your-resolver-ip>
         DNS Servers: <your-resolver-ip>

sudo bash -c 'cat > /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg <<EOF
network: {config: disabled}
EOF'

echo "nameserver <your-resolver-ip>" > /etc/resolv.conf

dns=<your-resolver-ip>

sudo systemctl restart NetworkManager

Your system is now configured to use its VPC-local DNS resolver. Use the dig command to verify DNS resolution is functioning properly. For usage examples, read How to Retrieve DNS Information Using Dig.