I have a Debian 2.6.26-2-xen-amd64 system which takes 5 seconds between the second and third failed reverse DNS lookup. All (most?) other similar systems here do the three lookups with little wait between them.

I have tried to figure out what might be causing the difference, but, so far, I have been unable to do so. What might it be?


Though I have observed the problem when logging to the machine with sshd, knowing slowness there is usually a problem with reverse dns, I have tested it using host. This is being provided by the package host, version 20000331-9.

Here's the tcpdump output of the test on two machines.

Host with delay:

11:47:58.883885 IP > 13275+ PTR? (42)
11:47:58.884258 IP > 13275 ServFail 0/0/0 (42)
11:47:58.884326 IP > 13275+ PTR? (42)
11:47:58.884804 IP > 13275 ServFail 0/0/0 (42)
11:48:03.892639 IP > 21337+ PTR? (42)
11:48:03.893282 IP > 21337 ServFail 0/0/0 (42)

Host without delay:

11:15:58.222147 IP > 2040+ PTR? (42)
11:15:58.222611 IP > 2040 ServFail 0/0/0 (42)
11:15:58.222718 IP > 2040+ PTR? (42)
11:15:58.223102 IP > 2040 ServFail 0/0/0 (42)
11:15:58.223197 IP > 20425+ PTR? (42)
11:15:58.223550 IP > 20425 ServFail 0/0/0 (42)
  • Can you amend your question to show the command you are using and the results you see? – RedGrittyBrick Oct 27 '10 at 13:41
  • @RedGrittyBrick Information appended, as requested. – Daniel C. Sobral Oct 27 '10 at 13:52
  • dig -x $ip +trace – Ash Palmer Oct 27 '10 at 20:01

Ok, the problem was the libnss-mdns package, which got installed as a recommended package with Java.


ServFail is an abnormal situation. Maybe later versions of BIND or the resolver library implement a more aggressive congestion avoidance strategy for ServFail? Are the two servers running different versions of BIND or the resolver library?

Since ServFail is unusual, indicating some DNS servers are not responding, a delay sending the third attempt shouldn't normally be causing you any additional issues. In my experience, loss of DNS service usually results in multi-second delays.

I suspect if you were getting, say, NXDOMAIN responses, you probably wouldn't see delays of many seconds.

If the DNS servers for the reverse-domain of the address in question were contactable and responsive, this wouldn't be an issue?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.