Hi all,

Looking at the resolv.conf manual, it suggests nameserver entries in the resolv.conf file are tried in turn until a response is received.

I have three DNS servers on my network all are listed in the resolv.conf file.

I took one of the DNS servers down the other day. It was the third entry in my Linux machines resolv.conf file. However, DNS resolution became very slow until I brought the DNS back up again.

Has the behaviour of resolv.conf changed and the manual not been updated? Can anyone think why this might have happened?

Thanks,
Ben

I thought (as you did probably too) that the list is read from top till bottom, one by one, but now that I think of it, it's not impossible that the list is read from bottom till top. Did you try taking the other servers out one by one, or could you possibly use a network sniffer to find out where it first tries to send the queries?

b0uncer

Now that i've fixed the issue, I can't recreate it. It certainly is working as expected now. A tcpdump shows a query to the first entry in the list (from top downwards) and it doesn't try the second unless the first fails.

I put a bogus address as the 3rd entry to simulate one of the DNS servers being down, but it doesn't suffer the performance issue I saw this morning.

To avoid any caching issues, i will leave the machine overnight and try again tomorrow.

Ill post the results.

Cheers,
Ben

Ok - ive found out what is going on.

Only SSH sessions were affected.

The machines I was having problems on are Red Hat EL3 with OpenSSH 3.6. The problem wasn't seen on Red Hat EL4 with OpenSSH 3.9.

What happens is that in earlier versions of OpenSSH - by default the SSH client tries to connect via ipv6 before it falls back to ipv4.

In our case it tries to resolve the hostname via ipv6, which fails. It then tries each DNS in turn, including the one that is down (causing the hangs) - when it fails on all servers it drops to ipv4 and then works.

Appending a -4 on the ssh command gets around the problem. But most of our users won't remember or want to do this.

Unfortunately the command "AddressFamily inet" which can be used in the ssh_config file to force ipv4 connectivity, does not work with OpenSSH 3.6. If I upgrade to a newer version I break the Enterprise model for RedHat and will no longer get auto updates for it.

I don't want to put an alias for each user adding the -4 as this is nasty and will get forgotten.

I guess Ill just leave it as it is - it only happens when a DNS is out of action and it doesn't actually stop ssh sessions, just slows the initial connection.

Hope this was of some use to someone!

Cheers,
Ben