Hello,
This is regarding a FreeBSD VPS, currently running 15.1. For a while, I've been having issues with certain tools—including curl, fetch, and git—reporting certificate errors trying to reach certain domains. Long story short, I eventually found that when a target had no IPv6 address, the resolver would fall back to the default search domain, even for qualified names. Because the server's domain has a DNS wildcard, it would resolve to itself. A quick example should illustrate this (with redactions; assume this is run on host.example.net):
In this example, /etc/resolv.conf only contains two nameserver lines. I'm able to work around the problem by ensuring that /etc/resolv.conf includes "search .", but it doesn't seem like this should be necessary. The issue does not occur with two dots in the target name (e.g., www.github.com). Should FreeBSD's resolver be falling back to search domains for qualified names? Is there a better fix or workaround?
Thanks
This is regarding a FreeBSD VPS, currently running 15.1. For a while, I've been having issues with certain tools—including curl, fetch, and git—reporting certificate errors trying to reach certain domains. Long story short, I eventually found that when a target had no IPv6 address, the resolver would fall back to the default search domain, even for qualified names. Because the server's domain has a DNS wildcard, it would resolve to itself. A quick example should illustrate this (with redactions; assume this is run on host.example.net):
# getent hosts github.com
<IPv6 of this server> example.net github.com.example.net
140.82.116.3 github.comIn this example, /etc/resolv.conf only contains two nameserver lines. I'm able to work around the problem by ensuring that /etc/resolv.conf includes "search .", but it doesn't seem like this should be necessary. The issue does not occur with two dots in the target name (e.g., www.github.com). Should FreeBSD's resolver be falling back to search domains for qualified names? Is there a better fix or workaround?
Thanks
