Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using stunnel in client mode to proxy between my Haproxy and a HTTPS backend server. I've read that Haproxy caches the resolved IPs on each config load, which isn't a problem in my current setup. However, it got me thinking whether or not stunnel caches the DNS results as well. I find that there's a delay = yes option which sounds like it should alleviate my concern. From the manual:

delay = yes | no

delay DNS lookup for connect option

This option is useful for dynamic DNS, or when DNS is not available during stunnel startup (road warrior VPN, dial-up configurations).

Delayed resolver mode is automatically engaged when stunnel fails to resolve on startup any of the connect targets for a service.

Delayed resolver inflicts failover = prio.

default: no

If I set delay = yes, will the DNS be resolved at every single connection, or does it use the OS's DNS cache (which would invalidate)?

share|improve this question

TL;DR: It doesn't cache the IP addresses

Asked this in the stunnel mail list, the author and maintainer Michal kindly responded to the question:

I specifically introduced the "delay" option to deal with dynamic IP addresses. Stunnel does not attempt to cache the IP addresses with "delay = yes". The local library may cache them, but it should honor the TTL.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.