On 2026-09-09 23:01:00 +0700, Max Nikulin wrote: > On 08/09/2026 6:13 pm, Vincent Lefevre wrote: > > This won't solve the problem: When nscd is used, /etc/gai.conf > > is not accessed at all, as shown by strace. There is just a > > connection to "/var/run/nscd/socket". > > Are you sure that gai.conf is not read by nscd even if client applications > like wget do not access it directly?
I don't know, but anyway it appears now that this shouldn't matter, because when the issue occurs, this is because getaddrinfo returns only the IPv6 address. This is not a question of precedence. > However, as you are describing the issue, editing that file will not > help you (I used it as a workaround a couple of times). Indeed. > What resolver plugins are configured on your machine? > > grep '^hosts:' /etc/nsswitch.conf hosts: files dns > In the case of faulty DNS servers I would consider another level of cache: > systemd-resolved or dnsmasq. > > When inspecting behavior of DNS servers, I suggest to suppress retries when > you invoke dig. It seems that this doesn't really matter. Even +retry=100 can fail: $ dig @140.77.51.20 bi.fr +retry=100 ; <<>> DiG 9.18.49-1~deb12u2-Debian <<>> @140.77.51.20 bi.fr +retry=100 ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 64265 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ; COOKIE: 63f177a1ec1096c4010000006aa1ebab8e413c5f5b0ef335 (good) ;; QUESTION SECTION: ;bi.fr. IN A ;; Query time: 32 msec ;; SERVER: 140.77.51.20#53(140.77.51.20) (UDP) ;; WHEN: Thu Sep 10 01:28:43 CEST 2026 ;; MSG SIZE rcvd: 62 (and a few seconds later, it succeeded). > Another idea is to use list of Debian mirrors to obtain enough host > names that are unlikely cached by DNS servers. Repeating dig for the > same host can not unveil some issues. I use different 2-letter domains. They generally exist and have an IP address. -- Vincent Lefèvre <[email protected]> - Web: <https://www.vinc17.net/> 100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/> Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)
