On 2026-09-11, Andy Smith <[email protected]> wrote: > Hi, > > On Thu, Sep 10, 2026 at 10:00:16AM +0700, Max Nikulin wrote: >> On 10/09/2026 6:37 am, Vincent Lefevre wrote: >> > this is because getaddrinfo returns only the IPv6 address. This is >> > not a question of precedence. >> >> Great. Do you see any benefits in disabling IPv6 on your machine? >> >> Have you figured out if changes made in libc to handle the case of SERVFAIL >> for A and success for AAAA queries affect nscd? Some security issues are >> mentioned in the bug tracker. > > I apologise that I haven't been able to follow this thread very well, > but I'm very interested in understanding what's going on. > > Am I right in understanding that the issue is that Vincent's DNS resolver is > returning SERVFAIL when querying A record but not when querying AAAA > record, the SERVFAIL is being cached by the machine's nscd and so > persistently applications do not get an A record to try to connect to, > just AAAA? > > If so, is it known why the resolver is so unreliable? > > I'm doubly interested because I have some machines using nscd. They are > only set to cache users to cut down on LDAP queries, not hosts, but if > whatever issue this is, is related to nscd, then I am a bit concerned > about it.
Apparently, you can set 'negative-time-to-live hosts 0' in the nscd.conf file to disable caching of failed hosts lookup. >> I expect that changing DNS configuration should solve you issue. > > What is the proposed configuration change to the DNS configuration? Is > this the resolver software, or are you talking about locally in > /etc/resolv.conf? > > Thanks, > Andy >
