dig

Captured 2026-08-03 from one CE of this deployment.

`dig`

{"command":["dig","volterra.azurecr.io"]}

; <<>> DiG 9.16.23-RH <<>> volterra.azurecr.io
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57771
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1224
; COOKIE: 92376ed790213a39 (echoed)
;; QUESTION SECTION:
;volterra.azurecr.io.    IN  A

;; ANSWER SECTION:
volterra.azurecr.io.  1421  IN  CNAME  22f7044cf29c444e8ca1c1ee28c49790.trafficmanager.net.
22f7044cf29c444e8ca1c1ee28c49790.trafficmanager.net. 300 IN CNAME eus-3.fe.azcr.io.
eus-3.fe.azcr.io.  510  IN  CNAME  eus-3-acr-reg.trafficmanager.net.
eus-3-acr-reg.trafficmanager.net. 157 IN CNAME  r0721eus-3-az.eastus.cloudapp.azure.com.
r0721eus-3-az.eastus.cloudapp.azure.com. 3 IN A  <public-ip>

;; Query time: 5 msec
;; SERVER: 168.63.129.16#53(168.63.129.16)
;; WHEN: Mon Aug 03 16:30:31 UTC 2026
;; MSG SIZE  rcvd: 250

Read status: in the header first — NOERROR with a non-zero ANSWER count is a successful lookup.

SERVER: at the bottom names the resolver that answered, which is the part worth checking: on an Azure node this is normally the platform resolver at 168.63.129.16, and something else there means the node is using a resolver you did not intend.

Registration failures often reduce to DNS. If the node cannot resolve register.ves.volterra.io or the container registry, nothing downstream will work, and this is the quickest way to prove it.

The command accepts the usual dig arguments, including @resolver to query a specific server — useful for showing that one resolver answers and another does not.