Skip to content

Fix the DNS to return NXDOMAIN - #2774

Merged
Lior Lieberman (LiorLieberman) merged 2 commits into
agent-substrate:mainfrom
bowei:pr-dns-fix-by-itself
Oct 16, 2026
Merged

Fix the DNS to return NXDOMAIN#2774
Lior Lieberman (LiorLieberman) merged 2 commits into
agent-substrate:mainfrom
bowei:pr-dns-fix-by-itself

Conversation

@bowei

@bowei Bowei Du (bowei) commented Oct 16, 2026 •
edited by LiorLieberman
Loading

Copy link
Copy Markdown
Collaborator
Library / Runtime Blocked Lookup Error (REFUSED → NXDOMAIN) Search Domain Traversal (.) (REFUSED → NXDOMAIN) musl Blocked Lookup Duration (REFUSED → NXDOMAIN)
glibc (C / C++ / Linux) EAI_AGAIN ("Temporary failure...") → EAI_NONAME ("Name or service not known") ❌ Aborted → ✅ Resolves via 2nd suffix N/A (glibc: 0.24s)
musl libc (Alpine Linux) EAI_AGAIN ("Try again") → EAI_NONAME ("Name does not resolve") ❌ Aborted → ✅ Resolves via 2nd suffix 1.06s → 0.06s
Golang (Pure Go) server misbehaving (IsTemporary: true) → no such host (IsNotFound: true) ✅ Resolved → ✅ Resolves via 2nd suffix 0.08s → 0.08s
Golang (cgo) Temporary failure / Try again → no such host ❌ Aborted → ✅ Resolves via 2nd suffix 1.08s → 0.09s
Node.js (dns.lookup) EAI_AGAIN → ENOTFOUND ❌ Aborted → ✅ Resolves via 2nd suffix 2.95s → 1.88s
Python (socket / asyncio) [Errno -3] Temporary failure / Try again → [Errno -2] Name or service not known / Name does not resolve ❌ Aborted → ✅ Resolves via 2nd suffix 3.20s → 2.24s
Python (dnspython) dns.resolver.NoNameservers (REFUSED) → dns.resolver.NXDOMAIN ❌ Aborted → ✅ Resolves via 2nd suffix 1.97s → 2.06s
Java (OpenJDK InetAddress) UnknownHostException: Temporary failure / Try again → UnknownHostException: Name or service not known / Name does not resolve ❌ Aborted → ✅ Resolves via 2nd suffix 2.17s → 1.17s
Java (Netty DnsNameResolver) DnsNameResolverException: REFUSED(5) → SearchDomainUnknownHostException / NXDOMAIN(3) ✅ Resolved → ✅ Resolves via 2nd suffix 10.84s → 11.10s
Rust (std::net::ToSocketAddrs) Temporary failure / Try again → Name or service not known / Name does not resolve ❌ Aborted → ✅ Resolves via 2nd suffix 1.05s → 0.05s
Rust (hickory-dns / trust-dns) NoRecordsFound { response_code: Refused } → NoRecordsFound { response_code: NXDomain } ✅ Resolved → ✅ Resolves via 2nd suffix 0.06s → 0.05s
  • Tests pass
  • Appropriate changes to documentation are included in the PR

@bowei
atunnel dns: use NXDOMAIN instead of REFUSED
f25ccf2 
REFUSED causes *libc to retry indefinitely with E_AI_AGAIN. NXDOMAIN
interoperates better with application stacks.
@bowei
doc: atunnel dns REFUSED -> NXDOMAIN
e2e3f2b
Merged via the queue into agent-substrate:main with commit 630f9d1 Oct 16, 2026
15 checks passed
@keithmattix Keith Mattix II (keithmattix) mentioned this pull request Oct 18, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@LiorLieberman Lior Lieberman (LiorLieberman) LiorLieberman approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bowei @LiorLieberman