[ILUG] DNS resolution problem

[stephen mulcahy]

Hi,

So after more debugging I've gotten to the bottom of this issue.

It seems name resolution behaviour has been changed in glibc to comply 
with RFC3484. The upshot of this is that the following is the typical 
sequence of events during name resolution - lets say I run command to 
access aaa.example.com

1. Query for for IPv6 record for aaa.example.com (AAAA record)
2. If query fails, query for IPv6 record aaa.example.com.<first value 
from search directive of resolv.conf>
3. If query fails, query for IPv6 record aaa.example.com.<second value 
from search directive of resolv.conf>
4. If query fails, query for IPv6 record aaa.example.com.<third value 
from search directive of resolv.conf>
5. and so on for each value in the search directive of your resolv.conf
6. If query fails, query for IPv4 record aaa.example.com (A record).
7. Success

Which explains all the spurious queries.

Once I knew what I was looking for, I googled a few references to this 
including

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=343140

It seems the fix is to change the address lookup order in /etc/gai.conf

Adding

ipv6.disable=1

to GRUB_CMDLINE_LINUX_DEFAULT in /etc/default/grub also seemed to have 
an affect but not for all commands so gai.conf modification is probably 
better.

I guess this isn't a big issue for most people but on a server which 
normally does a few million queries a day it does result in a noticeable 
increase in traffic! I would imagine defaulting to IPv4 lookups first 
would be better for the internet as a whole but obviously the smarter 
RFC authors disagree.

Thanks - hope this helps someone else,

-stephen



-- 
Stephen Mulcahy     Atlantic Linux         http://www.atlanticlinux.ie
Registered in Ireland, no. 376591 (144 Ros Caoin, Roscam, Galway)