[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Needless DNS queries



On Tue, 7 Jun 2022, Dan Ritter wrote:

Dieter Rohlfing wrote:
Hello everybody,

When a client queries for a domain and the answer is NXDOMAIN, there is
immediately a second query with the original domain name, but suffixed
with the domain name of my home network.

Example:

1. query: www.example.com (result NXDOMAIN)
2. query: www.example.com.home.lan (result NXDOMAIN)

home.lan is the domain name of my home network, /etc/resolv.conf
contains the following line:

search home.lan

When I delete this line from /etc/resolv.conf, then the second query
doesn't appear, but I loose the ability to use unqualified hostnames to
refer to local clients. :-((

Up to now I thought, the domain names in the search option is appended
only to unqualified names and not to qualified names. This assumption
seems to be false.

My question: is it possible to apply the search list only to
unqualified names?


search		Search list for host-name lookup.  By default, the search
list contains one entry, the local domain name.  It is determined from
the local hostname returned by gethostname(2); the local domain name is
taken to be everything after the first '.'. Finally, if the hostname
does not contain a '.', the root domain is assumed as the local domain
name

	This may be changed by listing the desired domain search
path following the search keyword with spaces or tabs separating the
names.  Resolver queries having fewer than ndots dots (default is
1) in them will be attempted using each component of the search path in
turn until a match is found.  For environments with multiple subdomains
please read options ndots:n below to avoid man-in-the-middle attacks
and unneces? sary traffic for the root-dns-servers.  Note that this
process may be slow and will generate a lot of network traffic if the
servers for the listed domains are not local, and that queries will time
out if no server is available for one of the domains.

==

so set ndots to 2, and try again.


I don't know what is going on here but that doesn't feel right unless
the OP has an options ndots:3 type setting already.

I'd suggest trying options ndots:1 - although that should be the default
anyway.


Reply to: