在VMware Cloud Foundation环境中更改DNS服务器时遇到问题。首先，客户已移除旧DNS服务器访问权限，导致SDDC Manager无法与vCenter通信。尝试在OVF属性中更改并在/etc/resolv.conf中更新，但重启后设置被恢复。通过在SDCC Manager的/etc/hosts文件中创建DNS记录解决了此问题。接着，更改DNS服务器时UI出现验证错误，但nslookup手动测试结果正常。深入日志发现最后检查的DNS地址是vCenter，可能是验证输出错误。查阅VCF 4.x知识库发现需要能ping通DNS服务器。客户添加防火墙规则允许ICMP ping后，成功验证DNS配置并完成更改。认为DNS验证输出存在问题，应明确指出是ping问题。

🔍 问题一：客户已移除旧DNS服务器访问权限，导致SDDC Manager无法与vCenter通信。尝试通过修改OVF属性和更新/etc/resolv.conf文件更改DNS设置，但重启虚拟机或DNS客户端服务后设置被恢复。

🏠 解决方案一：在SDCC Manager的/etc/hosts文件中手动创建DNS记录，使得SDDC Manager能够解析域名，从而可以登录到SDDC Manager。

🚫 问题二：在UI中更改DNS服务器时遇到验证错误，但nslookup手动测试显示DNS解析正常。开发者中心使用REST API进行验证时，日志显示最后检查的DNS地址是vCenter，而非实际DNS服务器，可能是验证工具输出错误。

🛡️ 解决方案二：根据VCF 4.x知识库（KB 314621），验证DNS配置需要DNS服务器可达。检查发现SDCC Manager无法ping通DNS服务器，原因是防火墙规则阻止了ICMP请求。客户添加允许SDCC Manager到DNS服务器的ICMP ping规则后，DNS配置验证通过，成功完成更改。

📝 经验总结：DNS验证工具的输出不够明确，未能准确指出是网络连通性问题（无法ping通）导致验证失败，而是错误地指向了DNS解析本身或其他环节。

I was trying to change DNS servers in an VMware Cloud Foundation environment, but I ran into some problems.

The first problem was that the customer already had removed access to the old DNS server, so the SDDC Manager could not talk to the vCenter.

I tried to make the change in the OVF properties and updating the /etc/resolv.conf file, but they changed back after restarting the VM or just restarting the DNS Client services. I solved this by creating DNS records in the /etc/hosts file on the SDCC Manager,

After that I could get the login to the SDDC Manager.

The the second problem was that when trying to change the DNS server i got a validation error in the UI, but not much information. I then tried to do the validation i the Developer Center and using the REST API for the validation. The result came with an error of validating the VC DNS/IP.

If I checked it manual with “nslookup” it came with the expected results, the looking deep into the logs i could see that the last DNS address to be checked was the vCenter, so maybe this was just a wrong message in the output from the validation.

Then i found this KB from VCF 4.x: https://knowledge.broadcom.com/external/article/314621/unable-to-update-dns-servers-using-the-s.html

I could see that there is a requirement for ping to the DNS server and I check this, and I could not ping them.

The Customer add a firewall rule for allowing ICMP Ping from the SDDC Manager to the DNS servers.

After this I could validate the DNS configuration and do the change of the DNS server.

I think that this is a really bad output from the DNS validation check it should show that the problem was with ping to den DNS servers.