Go "dial tcp: lookup proxy.golang.org: no such host" - Fix DNS in CI

By Kaveh Alemi·Latchkey

Go tried to reach the module proxy and DNS could not resolve its hostname. The name proxy.golang.org (or sum.golang.org) did not resolve - a transient DNS blip, a runner with no outbound DNS, or a network policy that blocks the lookup.

What this error means

A go mod download or build fails with dial tcp: lookup proxy.golang.org: no such host. It can be transient (a DNS hiccup that clears on retry) or persistent (a locked-down runner with no route to the public proxy).

go: github.com/example/lib@v1.4.0: reading
https://proxy.golang.org/github.com/example/lib/@v/v1.4.0.info:
dial tcp: lookup proxy.golang.org: no such host

Diagnose it: module path, proxy, or checksum?

Go module errors name the module but rarely the layer that failed. Separate the three: the module path does not resolve, the proxy cannot serve it, or the checksum database disagrees with what was downloaded.

# what Go resolves and from where
go env GOPROXY GOSUMDB GOPRIVATE GOFLAGS

# does the module resolve at all, bypassing the build?
go list -m -versions github.com/org/module

# verify the module cache against go.sum
go mod verify

# private modules must be excluded from proxy and sumdb
go env -w GOPRIVATE=github.com/yourorg/*

Common causes

Transient DNS resolution failure

A brief DNS outage or an overloaded resolver makes the proxy hostname fail to resolve for a single attempt, then succeed on retry.

A runner with no outbound DNS to the public proxy

A sandboxed or air-gapped runner cannot resolve external names, so every fetch through the public proxy fails until an internal mirror or DNS is provided.

A network policy blocking the lookup

An egress firewall or proxy that blocks DNS for golang.org domains turns every public-proxy fetch into a no-such-host error.

How to fix it

Retry a transient DNS failure

A momentary resolver blip usually clears on a second attempt.

for i in 1 2 3; do go mod download && break; sleep 5; done

Point GOPROXY at a reachable mirror

On a locked-down runner, route module fetches through an internal proxy whose hostname does resolve.

export GOPROXY=https://goproxy.internal.example.com,direct
go mod download

Serve modules from a warm cache

Caching the module cache between runs means most fetches never hit DNS at all.

- uses: actions/cache@v4
  with:
    path: ~/go/pkg/mod
    key: go-${{ hashFiles('go.sum') }}

How to prevent it

• Cache ~/go/pkg/mod so most builds skip the proxy entirely.
• Provide an internal GOPROXY mirror for sandboxed runners.
• Allow DNS/egress for the proxy domains your pipeline depends on.

Frequently asked questions

Related guides

References

• Go documentation
• GitHub Actions documentation