Why does my name resolution hit the DNS even with a hosts file entry?

Question

I'm running Ubuntu 10.04.2 LTS Desktop. Being a web developer, naturally I created a "me.com" in my /etc/hosts file. Unfortunately, my name resolution is going out to the DNS before first checking my local hosts entry and I can't figure out why.

The end result is that if my /etc/resolv.conf contains nameserver 127.0.0.1 in there first, then I get a response back in my web browser from me.com (local) within less than a second. But if I don't have that entry, then my response takes sometimes as much as 5 seconds if my ISP is a little slow.

The problem was so troublesome that I actually had to file a question here (and someone resolved it) for how to automatically insert that entry into /etc/resolv.conf. But one of the users (@shellholic) here highly recommended (and commented back and forth with me about it) that I should file this question.

Do you know why my workstation's name resolution has to hit the DNS server first before hitting my /etc/hosts file entry? For now, I'm using the resolv.conf trick.

Solution

The file /etc/nsswitch.conf will let you reconfigure the order of the name resolution. By default, the host file is the first, then the configured DNS. There could be more options.

The file /etc/hosts only lists IP addresses and hostnames (multiple names for one IP if you want)

The file /etc/resolv.conf will list the default search domains, and will also list in sequence the name servers to use.

Comments

[Admin]

You might try looking /etc/nsswitch.conf . The entries on my system are a little non-obvious, but you could test lookups with only files as an option and see if that made a difference.

[Admin]

Yes, could you give us the output of cat /etc/nsswitch.conf and cat /etc/host.conf? Also: how are you testing this (through pinging, browser, packet sniffing etc)?

[Admin]

To complete version of @arrange, could you attach the result of time getent hosts me.com; hostname --fqdn; grep 'me.com' /etc/hosts; grep hosts /etc/nsswitch.conf; netstat -uln | grep ':53'; cat /etc/host.conf; wc -l /etc/hosts. Don't hesitate to obfuscate rationality.

[Admin]

@shellholic ^rationality^rationally? heh.

[Admin]

@jgbelacqua: indeed

[Admin]

My host.conf shows "order hosts,bind". My nsswitch.conf shows "hosts:files mdns4_minimal [NOTFOUND=return] dns mdns4". I still need to do a time test following @shellholic's request. Just tight on time today.

[jfmessier]

Also keep in mind that once a name is resolved by an application or a service on your Linux box, it will remain in cache for a duration known as the TTL (time to live). So if you switch the resolution sequence, you are better restart your system or clear any cache.

[MK.]

how do you clear the 'cache'?

[Jacob Rodrigues]

nscd can cache name resolution queries, but does not respect ttl (and is therefore hosts caching is disabled by default). systemd-resolved will also cache entries. If none of those are configured, Linux hosts do not cache DNS responses. (Browsers likely do at the application layer though)