diff --git a/hbase-shaded/hbase-shaded-check-invariants/src/test/resources/ensure-jars-have-correct-contents.sh b/hbase-shaded/hbase-shaded-check-invariants/src/test/resources/ensure-jars-have-correct-contents.sh
index 8b63889f1950..25870a1897a6 100644
--- a/hbase-shaded/hbase-shaded-check-invariants/src/test/resources/ensure-jars-have-correct-contents.sh
+++ b/hbase-shaded/hbase-shaded-check-invariants/src/test/resources/ensure-jars-have-correct-contents.sh
@@ -131,6 +131,12 @@ for artifact in "${artifact_list[@]}"; do
   if [ ${#bad_contents[@]} -eq 0 ] && [ "${class_count}" -lt 1 ]; then
     bad_contents=("The artifact contains no java class files.")
   fi
+  # dnsjava ships its provider class only under META-INF/versions/, which relocation leaves at an
+  # unrelocated path in a jar that is not multi-release, so the declaration names a class the JVM
+  # cannot load and every DNS lookup in the process fails. See HBASE-30211.
+  if "${JAR}" tf "${artifact}" | grep -q '^META-INF/services/java\.net\.spi\.InetAddressResolverProvider$'; then
+    bad_contents+=("Declares java.net.spi.InetAddressResolverProvider, which breaks all DNS resolution on JDK18+")
+  fi
   if [ ${#bad_contents[@]} -gt 0 ]; then
     echo "[ERROR] Found artifact with unexpected contents: '${artifact}'"
     echo "    Please check the following and either correct the build or update"
diff --git a/hbase-shaded/hbase-shaded-with-hadoop-check-invariants/src/test/resources/ensure-jars-have-correct-contents.sh b/hbase-shaded/hbase-shaded-with-hadoop-check-invariants/src/test/resources/ensure-jars-have-correct-contents.sh
index 8b63889f1950..25870a1897a6 100644
--- a/hbase-shaded/hbase-shaded-with-hadoop-check-invariants/src/test/resources/ensure-jars-have-correct-contents.sh
+++ b/hbase-shaded/hbase-shaded-with-hadoop-check-invariants/src/test/resources/ensure-jars-have-correct-contents.sh
@@ -131,6 +131,12 @@ for artifact in "${artifact_list[@]}"; do
   if [ ${#bad_contents[@]} -eq 0 ] && [ "${class_count}" -lt 1 ]; then
     bad_contents=("The artifact contains no java class files.")
   fi
+  # dnsjava ships its provider class only under META-INF/versions/, which relocation leaves at an
+  # unrelocated path in a jar that is not multi-release, so the declaration names a class the JVM
+  # cannot load and every DNS lookup in the process fails. See HBASE-30211.
+  if "${JAR}" tf "${artifact}" | grep -q '^META-INF/services/java\.net\.spi\.InetAddressResolverProvider$'; then
+    bad_contents+=("Declares java.net.spi.InetAddressResolverProvider, which breaks all DNS resolution on JDK18+")
+  fi
   if [ ${#bad_contents[@]} -gt 0 ]; then
     echo "[ERROR] Found artifact with unexpected contents: '${artifact}'"
     echo "    Please check the following and either correct the build or update"
diff --git a/hbase-shaded/pom.xml b/hbase-shaded/pom.xml
index cd932dcccbcd..05b5243fae97 100644
--- a/hbase-shaded/pom.xml
+++ b/hbase-shaded/pom.xml
@@ -467,6 +467,9 @@
                       <exclude>jnamed*</exclude>
                       <exclude>lookup*</exclude>
                       <exclude>update*</exclude>
+                      <!-- SPI provider ships only under META-INF/versions/18; this jar is not
+                           multi-release, so keeping the service file breaks DNS on JDK18+ -->
+                      <exclude>META-INF/services/java.net.spi.InetAddressResolverProvider</exclude>
                     </excludes>
                   </filter>
                   <filter>