glibc resolver: DNS resolution latency with high ndots values

Direct answers

1. Per-pattern bypass? No. glibc's resolver has no mechanism to exempt specific domains or patterns from search-list appending. The only ways to skip the search list are:

• Use a fully qualified domain name with a trailing dot (e.g., example.com.), which makes the name absolute regardless of ndots.
• Ensure the name contains at least ndots dots so it is treated as absolute on the first attempt.

2. Priority when dot count < ndots? For a public FQDN such as example.com (one dot) with ndots:5, the resolver does not try the bare name first. It appends each search domain in order, waits for each response (often NXDOMAIN), and only after exhausting the search list does it query the name as-is.

Confirmed resolver ordering

• Dots ≥ ndots (or name ends with a dot): query the name as-is first; if that fails, fall back to search-list appending.
• Dots < ndots: iterate through the search list, appending each suffix; after all search attempts, try the bare name.
• Default ndots:1 means any name containing a dot is tried absolute-first; zero-dot names still use the search list.

Mitigations without lowering ndots globally

1. Emit trailing dots in application code for all external API hostnames. This is the only glibc-only way to guarantee absolute-first lookup.
2. Deploy a local caching resolver (e.g., systemd-resolved, Unbound, or dnsmasq) that answers internal search-suffix queries quickly and forwards public names directly. The stub resolver can also implement split-horizon routing so internal short names resolve without search-list walks.
3. If you control the search list, keep it short (one or two domains) and place the most likely internal suffix first to reduce NXDOMAIN round-trips.

Verification steps

# 1. Inspect current resolver configuration
cat /etc/resolv.conf

# 2. Trace actual query order for a public name
getent hosts example.com 2>&1 | head -20
# or with strace to see sendto/recvfrom sequence
strace -f -e trace=network getent hosts example.com 2>&1 | grep -E 'sendto|recvfrom'

# 3. Compare with a trailing-dot query
getent hosts example.com.

# 4. Test internal short names and dotted internal names before/after any change
getent hosts internal-service
getent hosts internal-service.corp.example

One diagnostic detail needed

Does your system use a local stub resolver such as systemd-resolved (check ls -l /etc/resolv.conf and systemctl status systemd-resolved)? If so, its Domains= and per-interface DNS routing can override glibc's search list, and the mitigation may need to be applied at the stub resolver layer instead.