On 2026-09-12 14:51:34 +0000, Andy Smith wrote:
> On Sat, Sep 12, 2026 at 02:25:30PM -0000, CGS wrote:
> > Apparently, you can set 'negative-time-to-live hosts 0' in the nscd.conf
> > file to disable caching of failed hosts lookup.
>
> OK. I can see how that would help if you're using nscd and the
> resolver is giving back failures.
No, that would not help for hosts that have both IPv4 and IPv6
addresses. Here's the dsecription in the nscd.conf(5) man page:
negative-time-to-live service secs
If an entry is not found by the Name Service, it is added to the
cache and marked as "not existent". This option sets the number
of seconds after which such a not existent entry is removed from
the cache. This defaults to 20 seconds for the password and host
caches and to 60 seconds for the group cache.
It says "not existent". It does *not* say "failure". In my case, the
entry is existent as the IPv6 address has been cached, so that the
failure for the IPv4 address does not count as "not existent".
This is confirmed by "This defaults to 20 seconds for the password and
host": if the "not existent" were the issue, it would have disappeared
after 20 seconds. But I could see that the missing IPv4 address for
AF_UNSPEC remains for a few hours (even though AF_INET succeeds).
I've checked that /etc/nscd.conf contains the default:
negative-time-to-live hosts 20
> Do we know why Vincent's DNS resolver is returning SERVFAIL more than
> expected?
No, except that these SERVFAIL are due to the nameservers (or
something beyond them), not the machine that does the query.
I opened a ticket on the internal helpdesk, but I haven't had any
reply yet. I don't even know whether this is new or not, since the
DNS configuration changed on the machines: previously, there were
3 additional nameserver lines, also local to the ENS-Lyon network
(if I understand correctly, these nameservers are no longer
officially supported).
And I don't know how the problematic nameservers are configured.
--
Vincent Lefèvre <[email protected]> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)
