A genuinely confusing one: dig db.internal returns the right address, but your application dies with Name or service not known. The difference is that dig talks to DNS directly, while applications go through the system resolver — and /etc/nsswitch.conf decides which sources that resolver consults.
Check the hosts line
getent hosts db.internal # uses nsswitch — empty = the real app-level failure grep '^hosts:' /etc/nsswitch.conf # healthy: hosts: files dns # broken: hosts: files <- no dns, so names never reach the resolver
getent is the key tool: it resolves through nsswitch exactly like your apps do, so it reproduces the failure that dig hides. The same applies to passwd: and group: lines for user/group lookups.
Fix the lookup order
Restore the sources on the relevant line in /etc/nsswitch.conf (e.g. hosts: files dns). The change takes effect for new lookups immediately — no daemon restart needed. If DNS itself is the problem instead, see troubleshooting DNS resolution.
Practise it
Name-service misconfigurations are part of the simulator's Linux incident set. Drill them in Linux troubleshooting practice.