Diag: agent DNS failure on intake, test from the agent network namespace

# Diag: agent cannot resolve the intake hostname

**Symptom (exact):** forwarder errors mentioning DNS failure / no such host for the intake endpoint of your site. Everything else on the box resolves fine.

**Likely causes:** (a) egress DNS blocked for the agent (VPC resolver rules, firewall), (b) proxy configured without DNS handling, (c) wrong site hostname typo in config, (d) split-horizon DNS in the VPC.

**Confirm:**

1. From the agent host (and from inside the agent container netns if containerized), resolve the intake hostname for your site. Fails here, works from your laptop: it is the host/VPC DNS path.
2. Check `datadog.yaml` for a hand-typed endpoint override with a typo. The default per-site endpoints need no override; custom `dd_url` values are a smell.
3. If behind a proxy: does the proxy do the DNS, or does the agent? Misconfigured proxy DNS is the classic corporate case.
4. Compare against a known-good host in the same subnet. Same failure means subnet/VPC-level, not the box.

**Fix:** allow DNS egress to the resolver, fix the proxy DNS settings, remove the typoed override, or add the VPC resolver rule. Restart the agent after network changes.

**Verify:** resolution succeeds from the agent netns, forwarder accepts payloads, host appears in Infrastructure. Add the intake endpoints to your network runbook so the next firewall change does not repeat this.