DNS resolves but the application is unreachable

Incident 2 min read Troubleshooting walkthrough

Work the problem

DNS is answering

Fictional case: The application name resolves to the expected IP. TCP port 443 times out from the affected client.

Which boundary has not yet passed?

Reasoning notebook

Record the evidence that supports your answer and the check you would run next. Your notes stay in this browser — nothing is uploaded.

Your hypothesis and reasoning

Why it happens

Resolution and reachability are independent, so a correct answer proves only that a record exists. The address can point at a decommissioned host, the service may not be listening, or a device in the path may drop that port while permitting ICMP. A load balancer VIP that answers ping with every member down produces precisely this.

Check this first

1PS> Test-NetConnection $Computer -Port $Port

What to look for

Name resolution succeeded, but that does not establish a route, permitted port or listening application.

Working through it

Run Test-NetConnection $Computer -Port $Port and read TcpTestSucceeded rather than the ping result.
On the target, check Get-NetTCPConnection -State Listen for something bound to that port and address.
Compare the resolved address against the host you believe is serving, since stale records are common after a migration.
Look for an inbound allow rule covering the port in Get-NetFirewallRule on the target.
Test from a second source on a different subnet to separate a host problem from a network path problem.

Avoiding it next time

Verify the repair: Retest the port from the affected client, then perform an application request; an open port alone is not a healthy transaction.

Primary documentation

PowerShell errors and debugging documentation