As a brute-force fix, you can disable DNS in /etc/nsswitch.conf and put the addresses you need (at least security.debian.org, YOUR_MIRROR) in /etc/hosts.