dns resolver behavior

i had an occasion to have to look up windows client behavior when it came to dns. specifically, i wanted to know how the client behaves when the primary name server is offline. before i had to fire up packet trace and check for myself, i stumbled on a couple of useful articles that spell it out.

UPDATE: had a conversation with a talented linux dns guy and discovered a few more useful things to note.

dns client resolver behavior
dns client resolution timeouts
dns forwarders and conditional forwarders resolution timeouts

in summary, it works as follows:

• dns query sent to preferred
• if no response within 1 second, dns query sent to alternate
• if no response within 1 second, dns query sent to preferred again
• if no response within 2 seconds, dns query sent to preferred and alternate
• if no response within 4 seconds, dns query sent to preferred and alternate again
• if no response within 7 seconds, process times out

 

something to note for linux systems, these appear to be default values:

• timeout:n
  sets the amount of time the resolver will wait for a response from a remote name server before retrying the query via a different name server.  Measured in seconds, the default is RES_TIMEOUT (currently 5, see <resolv.h>).  The value for this option is silently capped to 30.
• attempts:n
  sets the number of times the resolver will send a query to its name servers before giving up and returning an error to the calling application.  The default is RES_DFLRETRY (currently 2, see <resolv.h>).  The value for this option is silently capped to 5.
• rotate
  sets RES_ROTATE in _res.options, which causes round-robin selection of name servers from among those listed.  This has the effect of spreading the query load among all listed servers, rather than having all clients try the first listed server first every time.
• search
  Resolver queries having fewer than ndots dots default is 1) in them will be attempted using each component of the search path in turn until a match is found.
• ndots:n
  sets a threshold for the number of dots which must appear in a name given to res_query(3) (see resolver(3)) before an initial absolute query will be made.  The default for n is 1, meaning that if there are any dots in a name, the name will be tried first as an absolute name before any search list elements are appended to it.  The value for this option is silently capped to 15.

in summary, the timeout value indicates how long the client will wait until it tries the next server in the search list. the number of queries attempted per server is dependent on how ndots is configured. once the server list is exhausted, the attempts value indicates if the client should try the list again.

additional settings can be found here: http://man7.org/linux/man-pages/man5/resolver.5.html