host is able to resolve a hostname, ssh isn't

Whereas ssh and other programs such as ping use the glibc resolver to look up the host name ('pangolin' in this case), host looks the name up in DNS directly, bypassing the glibc resolver. That's the difference.

However, given that the glibc resolver is, on your machine, configured to try dns after files, I can't explain why the resolver fails where host succeeds.

To try with the glibc resolver, one can use getent hosts ... in place of host ....

I have seen this behavior reported before when dnsmasq was used as a local forwarding nameserver (https://bugs.launchpad.net/ubuntu/+source/dnsmasq/+bug/998712) but you aren't using such a local nameserver; but perhaps the problem there and here wasn't in dnsmasq but in the glibc resolver.

Your ssh may try to resolve IP6 and time out doing this. If you are not using IP6 try disabling IP6 in /etc/ssh/ssh_config by changing AddressFamily from any to inet.

i got this error by putting a domain entry line before the 2 nameserver lines by accident. nslookup worked. wget worked. ssh, scp, rsync failed.

moving domain to below nameservers and saving resolv.conf fixed. nothing else was necessary for me.