When you configure a data migration task or data synchronization task in Data Transmission Service (DTS), both databases pass the connectivity test but the precheck fails with the error "The DTS instance cannot connect to the source or destination database". The most common cause is missing or incomplete whitelist configuration.
Primary fix: Configure whitelists
Add the DTS IP address ranges to the whitelists of both the source and destination databases. This is the most frequent cause of this error, especially for cross-region tasks and self-managed databases.
For detailed instructions, see Whitelist DTS IP ranges for your self-managed database.
After updating the whitelists, return to the DTS task configuration and run the precheck again. If the connection issue is resolved, the precheck passes and you can proceed with the task.
Still failing? Check other causes
If the error persists after configuring whitelists, work through the following checklist:
| Cause | What to verify | Applies to |
|---|---|---|
| Security group rules blocking access | Inbound rules on the ECS instance or cloud firewall allow the DTS instance to connect on the correct database port. | Databases on ECS instances |
| Network routing issues | The network route between the DTS instance and the database is active and properly configured. Routing rules allow traffic from the DTS IP ranges to reach the database. | Self-managed databases connected through Express Connect, VPN Gateway, or Smart Access Gateway |
| Database listener configuration | The database accepts connections on the IP address and port specified in the DTS task, not only on localhost or a loopback address. For example, check the bind-address parameter for MySQL, listen_addresses for PostgreSQL, or bindIp for MongoDB. | All database types |
| Region alignment | The whitelisted IP ranges match the region where the DTS instance runs. Cross-region tasks use different IP addresses than same-region tasks. | Cross-region migration or synchronization tasks |
Why does the connectivity test pass but the precheck fails?
The connectivity test during task configuration and the precheck may use different network paths. The connectivity test verifies basic network reachability, but the precheck connects from the DTS infrastructure that actually runs the task, which may use a different set of IP addresses.
If the database has not whitelisted the IP addresses used by the DTS infrastructure, the precheck connection is refused even though the connectivity test succeeded. This distinction is especially important in two scenarios:
Cross-region migration or synchronization tasks -- The DTS instance may reside in a different region than the database, so the connection originates from a different set of IP addresses.
Self-managed databases -- If your database is hosted on your own infrastructure (on-premises or on an ECS instance), it may have stricter access controls that block connections from the DTS instance.