1

I have rotate and attempts settings in my resolv file:

nameserver 127.0.0.1
nameserver 10.104.64.25
nameserver 10.104.65.25
options timeout:1 attempts:3 rotate

And OS info is:

Linux 152a580f-e3c2-405f-acde-eac4d928af22 4.4.0-111-generic #134~14.04.1-Ubuntu SMP Mon Jan 15 15:39:56 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

And then I tried to do a dns resolution with curl:

# curl bbs.service.cf.internal
curl: (6) Could not resolve host: bbs.service.cf.internal

And tcpdump gives:

10.104.148.102.34753 > cn1c6ocvcu01.dummysite.net.domain: [bad udp cksum 0xe991 -> 0xd0f1!] 62383+ A? bbs.service.cf.internal. (41)
10.104.148.102.34753 > cn1c6ocvcu01.dummysite.net.domain: [bad udp cksum 0xe991 -> 0xc7f2!] 57774+ AAAA? bbs.service.cf.internal. (41)
cn1c6ocvcu01.dummysite.net.domain > 10.104.148.102.34753: [udp sum ok] 62383 NXDomain q: A? bbs.service.cf.internal. 0/1/0 ns: . [1h28m41s] SOA a.root-servers.net. nstld.verisign-grs.com. 2018111900 1800 900 604800 86400 (116)
cn1c6ocvcu01.dummysite.net.domain > 10.104.148.102.34753: [udp sum ok] 57774 NXDomain q: AAAA? bbs.service.cf.internal. 0/1/0 ns: . [1h28m41s] SOA a.root-servers.net. nstld.verisign-grs.com. 2018111900 1800 900 604800 86400 (116)

10.104.148.102.37052 > cn1c6ocvcu02.dummysite.net.domain: [bad udp cksum 0xea91 -> 0x41ad!] 30969+ A? bbs.service.cf.internal. (41)
10.104.148.102.37052 > cn1c6ocvcu02.dummysite.net.domain: [bad udp cksum 0xea91 -> 0xee5a!] 45387+ AAAA? bbs.service.cf.internal. (41)
cn1c6ocvcu02.dummysite.net.domain > 10.104.148.102.37052: [udp sum ok] 45387 NXDomain q: AAAA? bbs.service.cf.internal. 0/1/0 ns: . [2h25m58s] SOA a.root-servers.net. nstld.verisign-grs.com. 2018111900 1800 900 604800 86400 (116)
cn1c6ocvcu02.dummysite.net.domain > 10.104.148.102.37052: [udp sum ok] 30969 NXDomain q: A? bbs.service.cf.internal. 0/1/0 ns: . [2h25m58s] SOA a.root-servers.net. nstld.verisign-grs.com. 2018111900 1800 900 604800 86400 (116)

Actually, 127.0.0.1:53 is running a consul, which has the ability to resolve "bbs.service.cf.internal.", but the resolution process seems stopped at only two tries, and then returned failure. Why ? In my understanding, the query sequence should be: 10.104.64.25 -> 10.104.65.25 -> 127.0.0.1

roamer
  • 31
  • 2
  • Just one comment: rotate means load balancing the requests for any new search request. It will pick any of the three nameserver entries first. Without rotate, it will pick the nameservers in order top to bottom. See http://man7.org/linux/man-pages/man5/resolv.conf.5.html To me it looks as the answer to the first request is answered with "name not found" This means that there will not be any more DNS requests, since the first server already answered. – Ingvar J Nov 19 '18 at 10:01
  • @IngvarJ ROTATE not means "pick any", it will start from the SECOND nameserver and do round-robin. – roamer Nov 19 '18 at 10:11
  • I see you are using Ubuntu, so there might be som differences. I use Redhat, and it seems there was a bug in redhat6 picking the second entry and not the first. In Redhat 7 it is fixed (When I test it, it will pick the first entry in the nameserver list) See also https://access.redhat.com/solutions/1426263. Sorry for posting an irrelevant answer for Your use case. – Ingvar J Nov 20 '18 at 14:15
  • Now I tested it on ubuntu 18.04, and it seems to work. I used the testing method described in the redhat link above, using strace and a python script to verify the dns hosts called for when doing "getaddrinfo". It will pick the first entry followed by the second and third. Every time. – Ingvar J Nov 20 '18 at 14:32
  • @IngvarJ Yes, I know it would work follow the instructions. but i think you are trying a good URL which the second and third nameserver can resolve , something like 'www.bing.com',right ? have you tried to use a dummy site 'www.bingdummy.com' ? I think you would have the same issue I raised here. and it should have the same outputs as my above tcpdump captures. – roamer Nov 21 '18 at 05:35
  • Anyway, there seems to be a difference between ubuntu 14 and ubuntu 18. It will pick the first name server in the list. Reading your initial question again .... What you try to accomplish is to: ask nameserver1 for a domain resolution, then do it again with nameserver2? (and 3) If the first nameserver answers "I dont, know this domain" and refer to the upstream to topdomain, then it will not continue with the second nameserver in the list. – Ingvar J Nov 21 '18 at 08:51

0 Answers0