Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 1 Dec 2021 10:23:11 -0500
From: Rich Felker <>
To: Mark Hills <>
Subject: Re: DNS resolver fails prematurely when server reports

On Wed, Dec 01, 2021 at 12:49:07PM +0000, Mark Hills wrote:
> With multiple DNS servers in /etc/resolv.conf, the docs [1] are clear:
>   "musl's resolver queries them all in parallel and accepts whichever 
>    response arrives first."
> So dual configuration is expected to give greater resiliancy:
>   nameserver  # OVH
>   nameserver        # Cloudflare
> However, appears quite prone to some kind of internal SERVFAIL 
> (may be internal load shedding; though we are not making excessive DNS 
> queries)
> With glibc's cascading behaviour (or perhaps another OS) this may be dealt 
> with by the client.
> But if the wiki is read literally, the first response received is "this 
> server has failed" then a good response from another server is ignored?

No. ServFail is an inconclusive response, treated basically the same
as if no packet had arrived at all. (Slight difference: it triggers
immediate retry up to a limited number of times.)

> And indeed this seems to be the behaviour we experience, as removing 
> restored reliability.

Have you looked at a packet capture of what's happening? Likely was returning a false conclusive result (NxDomain or NODATA)
rather than ServFail.


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.