On 2026-09-24, Max Nikulin <[email protected]> wrote: > > Do you have an idea what specifically may be fixed in libnss_dns? I > expect that even libnss_resolve (with its own caching daemon) may cause > similar issues when (despite it is strange) nscd is running if front of > it. Any resolver may receive SERVFAIL.
It seems current systemd-resolved explicitly caches SERVFAIL, and the hard-coded cache lifetime is 10 seconds. https://github.com/systemd/systemd/blob/main/src/resolve/resolved-dns-cache.c?utm The source also contains an explicit dns_query_candidate_has_partially_succeeded() function. https://github.com/systemd/systemd/blob/main/src/resolve/resolved-dns-query.c This appears to obviate nscd's failure mode for this corner case, as resolved maintains two DnsTransactions and two cache keys; the A SERVFAIL cache entry stops preventing a new A transaction after 10 seconds (i.e. the next lookup).
