On 2026-09-12 23:10:03 +0700, Max Nikulin wrote: > On 12/09/2026 3:56 am, Andy Smith wrote: > > > Am I right in understanding that the issue is that Vincent's DNS resolver is > > returning SERVFAIL when querying A record but not when querying AAAA > > It seems, both A and AAAA queries may randomly fail when resource records > are not in the DNS server cache.
I confirm. > The same query sent a bit later (interval duration is not clear > however) may succeed. In my tests, this was about 2 seconds later, using up-arrow to recall the "dig" command from the shell history, then [Enter]. And this generally succeeds. Or always? (I don't remember whether I ever had a second failure with such a test.) > > the SERVFAIL is being cached by the machine's nscd and so > > persistently applications do not get an A record to try to connect to, > > just AAAA? > > Perhaps nscd ignores failure when the counterpart in A+AAAA query pair is > successful, so it caches either only IPv6 or only IPv4 addresses for the > given host. This is what I think. > Somebody has to look into nscd sources to give definitive answer > concerning cache implementation. > > I am curious what is the result of third command when first or second one > fails (multiple attempts varying SOMEHOST may be necessary to get an error): > > getent ahostsv4 SOMEHOST > getent ahostsv6 SOMEHOST > getent ahosts SOMEHOST With the following script: #!/bin/sh getent ahostsv4 $1 || echo "Error: $?" getent ahostsv6 $1 || echo "Error: $?" getent ahosts $1 || echo "Error: $?" I get (I recall that IPv6 is disabled in the kernel): [Host currently without nscd cache issue] arbre:~> gai vinc17.net Family: AF_UNSPEC [IPv4] IP: 155.133.131.76 (Port: 80) [IPv6] IP: 2001:4b99:1:3:216:3eff:fe20:ac98 (Port: 80) Family: AF_INET [IPv4] IP: 155.133.131.76 (Port: 80) Family: AF_INET6 [IPv6] IP: 2001:4b99:1:3:216:3eff:fe20:ac98 (Port: 80) arbre:~> ./getent-test vinc17.net 155.133.131.76 STREAM vinc17.net 155.133.131.76 DGRAM 155.133.131.76 RAW Error: 2 155.133.131.76 STREAM vinc17.net 155.133.131.76 DGRAM 155.133.131.76 RAW [Host currently with nscd cache issue] arbre:~> gai joooj.vinc17.net Family: AF_UNSPEC [IPv6] IP: 2001:4b99:1:3:216:3eff:fe20:ac98 (Port: 80) Family: AF_INET [IPv4] IP: 155.133.131.76 (Port: 80) Family: AF_INET6 [IPv6] IP: 2001:4b99:1:3:216:3eff:fe20:ac98 (Port: 80) arbre:~> ./getent-test joooj.vinc17.net Error: 2 Error: 2 Error: 2 > > If so, is it known why the resolver is so unreliable? > > My speculations: DDoS or improper protection against it on some parent DNS > server, configuration with too short timeouts there, unreliable network link > (e.g. issues with routing). I do not expect we will know what actually > happens. Firewall rules may also break things. > > but if whatever issue this is, is related to nscd, then I am a bit > > concerned about it. > > You may try to simulate DNS failures to check if Vincent's findings are > correct. This is what someone did for https://sourceware.org/bugzilla/show_bug.cgi?id=26601 (but in this test, nscd was not used). The "SERVFAIL simulator" is attached to this bug report. -- Vincent Lefèvre <[email protected]> - Web: <https://www.vinc17.net/> 100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/> Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)
