# /etc/resolv.conf: options attempts and timeout have no effect



## zhzgygkz (Jul 12, 2021)

Hey,

I'm using FreeBSD 13.0-RELEASE-p2 and came to notice that changing the /etc/resolv.conf options attempts and timeout has no effect.

According to the man page, attempts defaults to 2 and timeout defaults to 5. I can verify this by the following setup:
In my setup, the /etc/resolv.conf contains the following lines:


```
nameserver 10.0.0.1
nameserver 10.0.0.2
options attempts:1 timeout:1
```

Server with IP 10.0.0.1 does not respond to DNS queries.

A DNS lookup with or without the third "options" line, produces always the same output after 10 seconds, 10.0.0.2 is contacted and the query succeeds.

I must be missing something huge, please advise


----------



## SirDice (Jul 12, 2021)

zhzgygkz said:


> I must be missing something huge, please advise


DHCP might overwrite your changes to /etc/resolv.conf.


```
timeout:n     sets the initial amount of time the resolver
                               will wait for a response from a remote name
                               server before retrying the query via a
                               different name server.  The resolver may wait
                               longer during subsequent retries of the current
                               query since an exponential back-off is applied
                               to the timeout value.  Measured in seconds, the
                               default is RES_TIMEOUT, the allowed maximum is
                               RES_MAXRETRANS (see <resolv.h>).
```
Also note the second line about the exponential back-off.

And keep this in mind:

```
reload-period:n
                               The resolver checks the modification time of
                               /etc/resolv.conf every n seconds.  If
                               /etc/resolv.conf has changed, it is
                               automatically reloaded.  The default for n is
                               two seconds.  Setting it to zero disables the
                               file check.
```


----------



## zhzgygkz (Jul 12, 2021)

Thanks for the hint, I'm not using a DHCP client on these machines (verified via ps auxww | grep dhc).


----------



## zhzgygkz (Jul 12, 2021)

I've waited for more than the default 2 second period to let the resolver reload the /etc/resolv.conf.

AFAICT, attempts:1 timeout:1 is already the lowest possible setting for deadling with potentially unreachable nameservers, however, a delay of (reliably) 10 seconds is really high when it comes to dns resolution.

I'm unsure if exponential timeout explains the phenomenon I'm seeing. Could be. However I am really hoping that there is any way to let the resolver try a secondary server after only a few (1 or 2) seconds instead of 10.


----------



## SirDice (Jul 12, 2021)

Ideally your DNS should never be unreachable in the first place. What I did for a client was to set up two DNS servers (one slaved to the other) and used CARP to have a common address. I've set the CARP address as the primary DNS, secondairy and tertiary DNS are the two individual servers. So it's always available, regardless of which server happens to be online (or set to MASTER). Unless I take them both down of course, but then I've got much bigger problems.


----------



## zhzgygkz (Jul 12, 2021)

There are indeed several options available to make sure a single IP is always reachable:

CARP
Use an anycast IP (distributed via dynamic routing e.g. OSPF, BGP, Babel, etc.)
Set up a high availability cluster with reverse proxies for udp dns traffic
probably many more
Still, I'd really like to understand why these resolv.conf options

appear not to be working
do not work as described
do not work as expected


----------



## covacat (Jul 12, 2021)

how do you invoke the resolver ?

```
nameserver 192.168.1.1
nameserver 8.8.8.8
options attempts:1 timeout:1

[root@uk /usr/home/s]# time ping -c1 google.com
PING google.com (142.250.13.139): 56 data bytes
64 bytes from 142.250.13.139: icmp_seq=0 ttl=105 time=9.529 ms

--- google.com ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 9.529/9.529/9.529/0.000 ms

real    0m3.141s

===============================================================

nameserver 192.168.1.1
nameserver 8.8.8.8
#options attempts:1 timeout:1

[root@uk /usr/home/s]# time ping -c1 google.com
PING google.com (142.250.13.101): 56 data bytes
64 bytes from 142.250.13.101: icmp_seq=0 ttl=106 time=9.533 ms

--- google.com ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 9.533/9.533/9.533/0.000 ms

real    0m15.109s
```
it works for me with ping, fetch, nc
if I use host i have to use -W and -R resolv.conf seems to be ignored


----------



## zhzgygkz (Jul 12, 2021)

That's it. I was blindly using 
	
	



```
host(1)
```
 all the time. Reading through the man page now:

```
•   When parsing /etc/resolv.conf commands sortlist and options are
         ignored. [...]
```

*facepalm*


----------

