UDM Pro UTM CoreDNS Socket Crash Causing Selective Domain Blocking on Content-Filtered Network
Symptom
On a content-filtered network (VLAN), a client device lost Tailscale connectivity and could not reach a specific subdomain (ads.reddit.com), while the parent domain (reddit.com) remained accessible. Devices on a separate network without content filtering were unaffected. The UDM Pro showed 88 MB free RAM out of 3946 MB total, 1167 MB swap in use, and logged the error: 'Failed to send request to coredns: dial unix /run/utm/.cd_dl.sock: connect: resource temporarily unavailable'.
Context
The affected device was a UniFi client on a VLAN with UTM-based DNS content filtering enabled on a UDM Pro. A separate network without content filtering was unaffected. Time to resolve exceeded 24 hours.
Root cause
Severe memory pressure on the UDM Pro — 88 MB free RAM remaining out of 3946 MB total, with 1167 MB of swap in use — caused the UTM CoreDNS Unix socket (/run/utm/.cd_dl.sock) to crash and become unavailable. The top RAM and CPU consumers were the unifi process (22.4% CPU, 7.4% MEM) and unifi-protect (11.2% CPU, 6.5% MEM). With the socket unavailable, DNS content filtering on the affected VLAN failed in a way that selectively blocked certain domains rather than causing total DNS failure, making diagnosis non-obvious. The unfiltered network was unaffected because no content filtering was applied to it.
Resolution
Connected to the UDM Pro via SSH and restarted the unifi-mq-broker service followed by the udapi-server service. This recreated the UTM CoreDNS socket. After the restarts, free RAM recovered to 1031 MB, swap usage dropped to 1001 MB, and no further CoreDNS socket errors appeared in logs. Tailscale reconnected and the previously unreachable subdomain became accessible immediately. A full device reboot was not required.
What we learned
1. Memory pressure on the UDM Pro is an ongoing operational risk: the unifi and unifi-protect processes together consume significant RAM and can drive the system into swap exhaustion, which crashes the UTM CoreDNS socket. 2. When DNS content filtering malfunctions due to memory pressure, symptoms present as selective domain blocking rather than total DNS failure, making the root cause non-obvious. 3. Restarting unifi-mq-broker followed by udapi-server is the correct first-response procedure for UTM CoreDNS socket failures; a full reboot is a fallback only. 4. Proactive monitoring of free RAM and swap usage on the UDM Pro should be added to alerting to catch memory pressure before services crash.
Ops Intel investigates incidents like this automatically and remembers every fix. See plans →