Hi,

I am having an issue with squid and DNS and hope that someone else has seen this issue and can point me in the right direction.

The problem is that squid is erratic in resolving DNS for hosts that are going through the squid proxy. Squid will pass requests for clients for awhile and then suddenly come back with the error "cache was not able to resolve the hostname". If you wait awhile most of the time it will start working again but only for a short period of time, then come back with the error again.

The strange thing is that the localhost will work fine no matter what is going on with squid and you can also reach hosts by ip addess. I am running squid 2.5 with dansguardian 2.8.0.6, on FC5.

Any help would be greatly appreciated.

Thanks

Sounds like a timeout issue - squid giving up before the resolver. Check the squid configuration for DNS timeout and retry settings.

Are you using the default resolver library, Name Service Caching Daemon (nscd), a caching-only name server or a full bind 9 DNS server?

bind plus caching-nameserver.noarch should give a more stable, more reliable and faster solution than nscd. The system-config-network and system-config-bind packages should be able to handle the configuration for you in X-Windows.

Hi,

I bumped up the dns_timeout to 3 minutes and the dns_retransmit_interval to 10 seconds and still have the same results.

Wasn't running bind on this server but I did install it just to see if it would reslove the problem. I am still having issues and I am beginning to think this is a hardware issue with the firewall I have between the server and the Internet. I have the exact same configuration on another server and it works just fine. The only variable is the firewall. The other server goes out a different firewall. I will need to swap the connections and give this server a try on the "known good" firewall.

Thanks for the help.

Hi paulqwinn

Make sure httpd_accel_single_host is set to off for transparent proxying it is recommended to set to on then dns resolution on squid breaks - if it's off resolution is fine and so is transparent proxying.

Regards