What it means
wg-quick could not resolve the Endpoint host name when bringing the tunnel up.
Why it happens
- DNS is not available yet at boot (the tunnel starts before the network).
- A typo in the host name, or the DNS record does not exist.
- DNS works only through the tunnel that is not up yet.
How to fix it
- Check the name: dig vpn.example.com.
- Start the tunnel after the network: systemctl enable wg-quick@wg0 with After=network-online.target.
- Use the server IP in Endpoint if DNS is unreliable.
Useful tools
DNS lookup · WireGuard config generator
Other WireGuard errors
- Handshake for peer 1 (203.0.113.10:51820) did not complete after 5 seconds, retrying (try
- Packet has unallowed src IP (10.0.0.7) from peer 3 (198.51.100.20:43210)
- RTNETLINK answers: Operation not supported / Unable to access interface: Protocol not supp
- /usr/bin/wg-quick: line 32: resolvconf: command not found
- Key is not the correct length or format: `abc…`
- Unable to modify interface: Address already in use