Serverless compute resolves some public domains but not others

[LakehouseLad]

Hi everyone,

I’m troubleshooting outbound internet access from Databricks serverless compute and am seeing inconsistent DNS resolution.

For example, the GitHub API domain resolves successfully:

api [dot] github [dot] com

DNS: PASS -> DNS resolved successfully

I have also separately confirmed that an HTTPS request to the GitHub API succeeds with HTTP 200.

However, other common public domains fail during DNS resolution, including:

www [dot] google [dot] com
www [dot] cms [dot] gov
data [dot] cms [dot] gov
download [dot] cms [dot] gov

The DNS error is:

Name or service not known

HTTPS requests to these domains subsequently fail with:

NameResolutionError: Temporary failure in name resolution

My account is currently on the premium plan, although it originally started as a trial account, and I’m using serverless compute.

I also checked Account Console → Security → Networking. I do not have a "Context-based ingress & egress control" option under Policies. The available networking options I see are VPC endpoints, Network connectivity configurations, Classic network configurations, and Private access settings.

Since the GitHub API works but Google and several other public domains do not, outbound internet access does not appear to be completely disabled.

Has anyone seen serverless compute selectively fail DNS resolution for public domains like this?

Are there any other settings available on the Premium plan that could affect serverless DNS resolution or outbound internet access?

Any troubleshooting suggestions would be appreciated. Thanks!

[Satyasai]

Check this 
https://community.databricks.com/t5/administration-architecture/serverless-access-to-public-internet...

[LakehouseLad]

Thank you for the reply. I have already cheeked this thread and it was not able to solve my issue. I confirmed I am both in the "ACCOUNT CONSLE" and I am the "ACCOUNT ADMIN".

Because I am on PREMIUM PRICING, I do not have the "Context-based ingress & egress control" section in my account console. This is all I see in the Security -> Networking in account console:

Any other ideas how to solve this outbound issue for premium?

[data_pulse]

@LakehouseLad 

One other useful way to validate this is through the system.access.outbound_network system table. Databricks records denied outbound network requests there, including DNS destinations. Docs here.

SELECT
  event_time,
  event_id,
  destination_type,
  destination,
  dns_event,
  access_type,
  network_source_type
FROM system.access.outbound_network
WHERE event_time >= current_timestamp() - INTERVAL 2 HOURS
ORDER BY event_time DESC;

Re-try the failing domains from serverless compute and check if they exist in the result set of above query.

Look for dns_event: Dns details including response code, access_type: Drop indicates the request was denied.

If the failed DNS requests are showing up as DROP, that would indicate this is an outbound network denial rather than a normal public DNS lookup failure.

[LakehouseLad]

Yep access_type = 'DROP' for www [dot] google [dot] com. Any idea how to solve on PREMIUM pricing?

[data_pulse]

@LakehouseLad 

I also tested the same from a Premium tier workspace, and the same public domains resolve successfully there. So this does not appear to be a general Premium tier limitation.

In the screenshot you posted is showing the DNS request as DROP with rcode=5, which indicates the request is being explicitly refused somewhere in the serverless outbound networking path.

This could also be workspace/region-specific rather than a subscription-tier restriction. capture the event_id, timestamp, workspace region and failing domains and raise it with Databricks Support.

Could you also try doing the same exercise to run with standard/classic compute in the affected workspace. If that succeeds while serverless continues to show DROP, it further isolates the issue to serverless networking.

Further, we have Network Connectivity Configurations (NCC) being set and attached to the workspaces. Can check this from your Account Console. NCC are used specifically for serverless outbound connectivity. Can refer the docs here.