MongoDB Compass: Persistent "queryTxt ECONNREFUSED" error when connecting to Azure cluster

Question

MongoDB Compass: Persistent "queryTxt ECONNREFUSED" error when connecting to Azure cluster

Homelab Platypus 0

Hi everyone,

In my Azure project, I have a 'Azure DocumentDB (with MongoDB compatibility)' resource. About a month ago, I was able to use MongoDB Compass (ver 1.50) on my laptop to successfully connect to the MongoDB cluster. After not using Compass for about a month (maybe two?), I went to use Compass again today. Now I consistently get this error:

queryTxt ECONNREFUSED my-cluster.global.mongocluster.cosmos.azure.com

FYI, the connection string I get off the Azure Portal is this:

mongodb+srv://me:******@my-cluster.global.mongocluster.cosmos.azure.com/?tls=true&authMechanism=SCRAM-SHA-256&retrywrites=false&maxIdleTimeMS=120000

I've done all of the following to troubleshoot:

In Compass: Replaced the connection string multiple times. Yes, I'm certain the password is correct.
Enabled "permit all" in MongoDB firewall rules
DNS testing:
- SRV lookup succeeds using nslookup
- Node resolveSrv succeeds
- Node resolveTxt returns normal ENODATA
- TCP port 10260 succeeds
- Pointed to multiple DNS servers
Tried connecting with both MongoDB Compass and mongosh

The DNS testing always passed. However, every time I tried to connect to the MongoDB cluster itself, always the same error: "queryTxt ECONNREFUSED"

My research suggests this is a DNS resolution issue, but I can't replicate that issue when testing DNS alone.

Anyone else seen this?

0 comments

1 answer

Your answer

Answer 1

Abdul Waqas 345

Hi,

Based on the troubleshooting already completed, DNS does not appear to be the main issue. Since the SRV, TXT, DNS resolution, and TCP connectivity to port 10260 are working, I would focus on the cluster’s networking and connection settings.

I suggest checking:

Azure Portal → Cosmos DB for MongoDB vCore → Networking and confirm the public access/firewall rules allow the laptop’s public IP.

Confirm the cluster is in a Ready/healthy state and there have been no recent networking or private endpoint changes.

In MongoDB Compass, use the exact connection string provided by Azure Portal and make sure no conflicting Replica Set Name is configured.

Test the same connection string using mongosh from the same laptop. If it fails with the same queryTxt ECONNREFUSED error, the issue is likely not specific to Compass.

If DNS and TCP/10260 are working but mongosh also fails, I would focus on the Azure networking/firewall configuration and then consider a possible service-side issue rather than continuing with DNS troubleshooting.

Microsoft documents MongoDB vCore connectivity over port 10260 and recommends using the connection details provided by Azure.

**Microsoft Learn references:

**https://learn.microsoft.com/en-us/azure/cosmos-db/mongodb/connect-using-compass⁠

https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-configure-firewall⁠

https://learn.microsoft.com/en-us/azure/cosmos-db/mongodb/connect-account⁠

Homelab Platypus 0 Reputation points

2026-09-04T19:09:43.2733333+00:00
Hello,

I completed the additional troubleshooting. The issue now appears to be isolated to the mongodb+srv DNS discovery process rather than the cluster firewall, authentication, TLS, or basic network connectivity.

Current cluster configuration/status:

provisioningState: Succeeded

clusterStatus: Ready

publicNetworkAccess: Enabled

No private endpoints configured

For troubleshooting, I added an AllowAll IPv4 firewall rule

Recent Activity Log entries do not show any relevant failures

The Azure Portal provides this connection string:

mongodb+srv://platypusadmin:<password>@homelabplatypus-cluster.global.mongocluster.cosmos.azure.com/?tls=true&authMechanism=SCRAM-SHA-256&retrywrites=false&maxIdleTimeMS=120000

Using this string:

MongoDB Compass fails with queryTxt ECONNREFUSED

mongosh also fails with queryTxt ECONNREFUSED

However, manually resolving the SRV record succeeds. It returns:

fc-fa0212848030-000.global.mongocluster.cosmos.azure.com:10260

I then bypassed SRV/TXT discovery and connected directly using:

mongodb://platypusadmin:<password>@fc-fa0212848030-000.global.mongocluster.cosmos.azure.com:10260/?tls=true&authMechanism=SCRAM-SHA-256&retryWrites=false&maxIdleTimeMS=120000&directConnection=true

This direct connection succeeds in both mongosh and MongoDB Compass. In Compass, I can browse the database and its data normally.

Therefore, the current results are:

SRV lookup: succeeds

Direct TCP connectivity to port 10260: succeeds

Direct mongodb:// connection: succeeds

TLS/authentication: succeeds

MongoDB Compass direct connection: succeeds

mongosh direct connection: succeeds

Azure-provided mongodb+srv:// connection: fails in both clients with queryTxt ECONNREFUSED

A standalone Node.js dns.resolveTxt() query for the cluster hostname returns ENODATA, while the MongoDB clients report queryTxt ECONNREFUSED when processing the mongodb+srv connection.

At this point, it appears that the issue is specifically associated with the SRV/TXT discovery path used by the Azure-provided connection string. Manually resolving the SRV record and connecting directly to the returned host and port works.

Could you advise what should be investigated next, particularly why the Azure-provided mongodb+srv URI is triggering the queryTxt ECONNREFUSED failure?

Thank you.
Abdul Waqas 345 Reputation points

2026-09-04T19:15:14.11+00:00
Hi,

Your additional testing narrows this down significantly. Since mongosh and MongoDB Compass both connect successfully using the direct fc-...:10260 endpoint, but both fail with the Azure-generated mongodb+srv:// connection string, this is unlikely to be a firewall, authentication, TLS, or basic connectivity issue.

The main difference is the SRV/TXT discovery used by mongodb+srv://.

I recommend checking the following:

Query the SRV and TXT records for the exact cluster hostname.

Repeat the TXT lookup using a public DNS resolver such as 8.8.8.8 or 1.1.1.1.

If SRV works but TXT consistently returns ENODATA/no record, capture the results as evidence.

Check where the queryTxt ECONNREFUSED response is coming from — the local DNS resolver, an intermediate DNS server, or the Azure endpoint.

At this point, I would avoid changing firewall or authentication settings since the direct connection is already working.

I would raise this with the Azure Cosmos DB for MongoDB vCore team and provide the following comparison:

SRV discovery: Works

SRV target / port 10260: Reachable

Direct mongodb:// connection: Works

TLS/authentication: Works

mongodb+srv:// connection: Fails in both clients

TXT lookup: ENODATA

Client error: queryTxt ECONNREFUSED

This points more toward an issue with the TXT record/discovery path or the service-generated SRV/TXT configuration than the cluster firewall.

**Microsoft Learn references:**Hi,

Your additional testing narrows this down significantly. Since mongosh and MongoDB Compass both connect successfully using the direct fc-...:10260 endpoint, but both fail with the Azure-generated mongodb+srv:// connection string, this is unlikely to be a firewall, authentication, TLS, or basic connectivity issue.

The main difference is the SRV/TXT discovery used by mongodb+srv://.

I recommend checking the following:

Query the SRV and TXT records for the exact cluster hostname.

Repeat the TXT lookup using a public DNS resolver such as 8.8.8.8 or 1.1.1.1.

If SRV works but TXT consistently returns ENODATA/no record, capture the results as evidence.

Check where the queryTxt ECONNREFUSED response is coming from — the local DNS resolver, an intermediate DNS server, or the Azure endpoint.

At this point, I would avoid changing firewall or authentication settings since the direct connection is already working.

I would raise this with the Azure Cosmos DB for MongoDB vCore team and provide the following comparison:

SRV discovery: Works

SRV target / port 10260: Reachable

Direct mongodb:// connection: Works

TLS/authentication: Works

mongodb+srv:// connection: Fails in both clients

TXT lookup: ENODATA

Client error: queryTxt ECONNREFUSED

This points more toward an issue with the TXT record/discovery path or the service-generated SRV/TXT configuration than the cluster firewall.

**Microsoft Learn references:
**https://learn.microsoft.com/en-us/azure/cosmos-db/mongodb/connect-account⁠

https://learn.microsoft.com/en-us/azure/cosmos-db/mongodb/vcore/troubleshoot-common-issues⁠