Re: [musl] DNS resolver fails prematurely when server reports failure?

[Rich Felker <dalias@libc.org>]

On Wed, Dec 01, 2021 at 12:49:07PM +0000, Mark Hills wrote:
> With multiple DNS servers in /etc/resolv.conf, the docs [1] are clear:
> 
>   "musl's resolver queries them all in parallel and accepts whichever 
>    response arrives first."
> 
> So dual configuration is expected to give greater resiliancy:
> 
>   nameserver 213.186.33.99  # OVH
>   nameserver 1.1.1.1        # Cloudflare
> 
> However, 1.1.1.1 appears quite prone to some kind of internal SERVFAIL 
> (may be internal load shedding; though we are not making excessive DNS 
> queries)
> 
> With glibc's cascading behaviour (or perhaps another OS) this may be dealt 
> with by the client.
> 
> But if the wiki is read literally, the first response received is "this 
> server has failed" then a good response from another server is ignored?

No. ServFail is an inconclusive response, treated basically the same
as if no packet had arrived at all. (Slight difference: it triggers
immediate retry up to a limited number of times.)

> And indeed this seems to be the behaviour we experience, as removing 
> 1.1.1.1 restored reliability.

Have you looked at a packet capture of what's happening? Likely
1.1.1.1 was returning a false conclusive result (NxDomain or NODATA)
rather than ServFail.

Rich