funny DNS resolution

Its quite funny how the /etc/resolv.conf is parsed in [tag]SuSE[/tag] 10.1 [tag]Linux[/tag]. The /etc/resolv.conf file is the configuration file that is used by the [tag]DNS[/tag] resolver. One of the keywords that is permitted in this file is the search keyword. This keyword is used to provide a list of domains to search under when a hostname (not FQDN) is given.

Did you know ?

The search list is currently limited to SIX domains and a total of 256 characters only

There are two ways to enter multiple domains using the search keyword and I have observed differences in how the name resolution works using each method.

1. Method One: Specify one domain per line with the search keyword.

   Example:
   

   search foo.com
search bar.com
search foobar.com


   If a host, say intranet exists in all the three domains, then without trying, one would presume that the host in domain foo.com is returned. However, it appears that the last search domain is looked up first, followed by the penultimate one etc.

   Example:
   
a) /etc/resolv.conf settings
search foo.com
search bar.com
search foobar.com

   # nslookup intranet
   Server: 10.0.0.1
   Address: 10.0.0.1#53

   intranet.foobar.com canonical name = intranet.foobar.com.
   Name: intranet.foobar.com
   Address: 10.0.1.10

   b) /etc/resolv.conf settings
   search bar.com
   search foobar.com
   search foo.com

   # nslookup intranet
   Server: 10.0.0.1
   Address: 10.0.0.1#53

   intranet.foo.com canonical name = intranet.foo.com.
   Name: intranet.foo.com
   Address: 10.0.2.10

   c) /etc/resolv.conf settings
   search foobar.com
   search foo.com
   search bar.com

   # nslookup intranet
   Server: 10.0.0.1
   Address: 10.0.0.1#53

   Non-authoritative answer:
intranet.bar.com canonical name = intranet.bar.com.
Name: intranet.bar.com
Address: 10.0.3.10


2. Method Two: Specify the search list in one line, separated by space or tab.

   Example:
   
search foo.com bar.com foobar.com

   In this example, the behavior is as expected. The domain foo.com is searched, followed by bar.com and then followed by foobar.com

a) /etc/resolv.conf settings
search: foo.com bar.com foobar.com

   # nslookup intranet
   Server: 10.0.0.1
   Address: 10.0.0.1#53

   intranet.foo.com canonical name = intranet.foo.com.
   Name: intranet.foo.com
   Address: 10.0.2.10

   b) /etc/resolv.conf settings
   search: bar.com foobar.com foo.com

   # nslookup intranet
   Server: 10.0.0.1
   Address: 10.0.0.1#53

   intranet.bar.com canonical name = intranet.bar.com.
   Name: intranet.bar.com
   Address: 10.0.3.10

   c) /etc/resolv.conf settings
   search: foobar.com foo.com bar.com

   # nslookup intranet
   Server: 10.0.0.1
   Address: 10.0.0.1#53

   intranet.foobar.com canonical name = intranet.foobar.com.
Name: intranet.foobar.com
Address: 10.0.1.10