On 12/09/2026 3:56 am, Andy Smith wrote:
Am I right in understanding that the issue is that Vincent's DNS resolver is
returning SERVFAIL when querying A record but not when querying AAAA
It seems, both A and AAAA queries may randomly fail when resource
records are not in the DNS server cache. The same query sent a bit later
(interval duration is not clear however) may succeed.
the SERVFAIL is being cached by the machine's nscd and so
persistently applications do not get an A record to try to connect to,
just AAAA?
Perhaps nscd ignores failure when the counterpart in A+AAAA query pair
is successful, so it caches either only IPv6 or only IPv4 addresses for
the given host. Somebody has to look into nscd sources to give
definitive answer concerning cache implementation.
I am curious what is the result of third command when first or second
one fails (multiple attempts varying SOMEHOST may be necessary to get an
error):
getent ahostsv4 SOMEHOST
getent ahostsv6 SOMEHOST
getent ahosts SOMEHOST
If so, is it known why the resolver is so unreliable?
My speculations: DDoS or improper protection against it on some parent
DNS server, configuration with too short timeouts there, unreliable
network link (e.g. issues with routing). I do not expect we will know
what actually happens.
but if
whatever issue this is, is related to nscd, then I am a bit concerned
about it.
You may try to simulate DNS failures to check if Vincent's findings are
correct.
I expect that changing DNS configuration should solve you issue.
What is the proposed configuration change to the DNS configuration? Is
this the resolver software, or are you talking about locally in
/etc/resolv.conf?
I had in mind using other DNS servers, maybe even DNS over HTTPS. I
would consider another local DNS cacher: dnsmasq or systemd-resolved.
Later I have noticed "no-aaaa" in resolv.conf options, but it specific
to the case when IPv6 is not used at all.
