The public dockerhub registry has two CNAMEs in its DNS record.
Here's a healthy dig response from an OSX-10.9.5 host:
sbuss@sbuss-local$ dig registry-1.docker.io
; <<>> DiG 9.8.3-P1 <<>> registry-1.docker.io
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50936
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;registry-1.docker.io. IN A
;; ANSWER SECTION:
registry-1.docker.io. 149 IN CNAME elb-registry.us-east-1.aws.dckr.io.
elb-registry.us-east-1.aws.dckr.io. 316 IN CNAME us-east-1-elbregis-10fucsvj1tcgy-133821800.us-east-1.elb.amazonaws.com.
us-east-1-elbregis-10fucsvj1tcgy-133821800.us-east-1.elb.amazonaws.com. 54 IN A 52.20.119.187
us-east-1-elbregis-10fucsvj1tcgy-133821800.us-east-1.elb.amazonaws.com. 54 IN A 52.7.116.223
us-east-1-elbregis-10fucsvj1tcgy-133821800.us-east-1.elb.amazonaws.com. 54 IN A 52.20.61.0
;; Query time: 945 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed Dec 16 16:03:17 2015
;; MSG SIZE rcvd: 216Notice that we have two CNAMEs in the answer section.
If I run that same command on virtualbox with --natdnshostresolver1 on, I
get one of three failures:
sbuss@counsyl-scratch:~$ dig registry-1.docker.io
;; Got bad packet: bad label type
220 bytes
6b 4e 85 a0 00 01 00 05 00 00 00 01 0a 72 65 67 kN...........reg
69 73 74 72 79 2d 31 06 64 6f 63 6b 65 72 02 69 istry-1.docker.i
6f 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0e 10 o...............
00 48 2a 75 73 2d 65 61 73 74 2d 31 2d 65 6c 62 .H*us-east-1-elb
72 65 67 69 73 2d 31 30 66 75 63 73 76 6a 31 74 regis-10fucsvj1t
63 67 79 2d 31 33 33 38 32 31 38 30 30 09 75 73 cgy-133821800.us
2d 65 61 73 74 2d 31 03 65 6c 62 09 61 6d 61 7a -east-1.elb.amaz
6f 6e 61 77 73 03 63 6f 6d 00 c0 32 00 05 00 01 onaws.com..2....
00 00 0e 10 00 24 0c 65 6c 62 2d 72 65 67 69 73 .....$.elb-regis
74 72 79 09 75 73 2d 65 61 73 74 2d 31 03 61 77 try.us-east-1.aw
73 04 64 63 6b 72 02 69 6f 00 c0 86 00 01 00 01 s.dckr.io.......
00 00 0e 10 00 04 34 14 77 bb c0 86 00 01 00 01 ......4.w.......
00 00 0e 10 00 04 34 14 3d 00 c0 86 00 01 00 01 ......4.=.......
00 00 0e 10 00 04 34 07 74 df bd 01 ......4.t...
sbuss@counsyl-scratch:~$ dig registry-1.docker.io
;; Got bad packet: bad compression pointer
220 bytes
95 63 85 a0 00 01 00 05 00 00 00 01 0a 72 65 67 .c...........reg
69 73 74 72 79 2d 31 06 64 6f 63 6b 65 72 02 69 istry-1.docker.i
6f 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0e 10 o...............
00 48 2a 75 73 2d 65 61 73 74 2d 31 2d 65 6c 62 .H*us-east-1-elb
72 65 67 69 73 2d 31 30 66 75 63 73 76 6a 31 74 regis-10fucsvj1t
63 67 79 2d 31 33 33 38 32 31 38 30 30 09 75 73 cgy-133821800.us
2d 65 61 73 74 2d 31 03 65 6c 62 09 61 6d 61 7a -east-1.elb.amaz
6f 6e 61 77 73 03 63 6f 6d 00 c0 32 00 05 00 01 onaws.com..2....
00 00 0e 10 00 24 0c 65 6c 62 2d 72 65 67 69 73 .....$.elb-regis
74 72 79 09 75 73 2d 65 61 73 74 2d 31 03 61 77 try.us-east-1.aw
73 04 64 63 6b 72 02 69 6f 00 c0 86 00 01 00 01 s.dckr.io.......
00 00 0e 10 00 04 34 14 77 bb c0 86 00 01 00 01 ......4.w.......
00 00 0e 10 00 04 34 14 3d 00 c0 86 00 01 00 01 ......4.=.......
00 00 0e 10 00 04 34 07 74 df ce 79 ......4.t..y
sbuss@counsyl-scratch:~$ dig registry-1.docker.io
;; Warning: Message parser reports malformed message packet.
; <<>> DiG 9.9.5-3ubuntu0.5-Ubuntu <<>> registry-1.docker.io
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50476
;; flags: qr aa rd ra ad; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: Message has 1 extra bytes at end
;; QUESTION SECTION:
;registry-1.docker.io. IN A
;; ANSWER SECTION:
registry-1.docker.io. 3600 IN CNAME us-east-1-elbregis-10fucsvj1tcgy-133821800.us-east-1.elb.amazonaws.com.
us-east-1-elbregis-10fucsvj1tcgy-133821800.us-east-1.elb.amazonaws.com. 3600 IN CNAME elb-registry.us-east-1.aws.dckr.io.
elb-registry.us-east-1.aws.dckr.io. 3600 IN A 52.20.61.0
elb-registry.us-east-1.aws.dckr.io. 3600 IN A 52.20.119.187
elb-registry.us-east-1.aws.dckr.io. 3600 IN A 52.7.116.223
;; Query time: 5 msec
;; SERVER: 10.0.2.3#53(10.0.2.3)
;; WHEN: Wed Dec 16 15:52:57 PST 2015
;; MSG SIZE rcvd: 220This ANSWER section is wrong -- it says that registry-1.docker.io
points to an ELB, which points to elb-registry.us-east-1.aws.dckr.io.
From inside the vbox machine, if I dig against google's public DNS server I see the correct response, so this must be virtualbox's dns custom resolver:
sbuss@counsyl-scratch:~$ dig @8.8.8.8 registry-1.docker.io
; <<>> DiG 9.9.5-3ubuntu0.5-Ubuntu <<>> @8.8.8.8 registry-1.docker.io
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53422
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;registry-1.docker.io. IN A
;; ANSWER SECTION:
registry-1.docker.io. 209 IN CNAME elb-registry.us-east-1.aws.dckr.io.
elb-registry.us-east-1.aws.dckr.io. 95 IN CNAME us-east-1-elbregis-10fucsvj1tcgy-133821800.us-east-1.elb.amazonaws.com.
us-east-1-elbregis-10fucsvj1tcgy-133821800.us-east-1.elb.amazonaws.com. 59 IN A 52.20.61.0
us-east-1-elbregis-10fucsvj1tcgy-133821800.us-east-1.elb.amazonaws.com. 59 IN A 52.20.119.187
us-east-1-elbregis-10fucsvj1tcgy-133821800.us-east-1.elb.amazonaws.com. 59 IN A 52.7.116.223
;; Query time: 46 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed Dec 16 15:56:53 PST 2015
;; MSG SIZE rcvd: 227
I've run into this same issue. Were you able to resolve this?