DNS forward fails with SERVFAIL/timeout when using 1.1.1.1 fallback #12

New issue

Open

opened 2026-02-11 10:13:23 +00:00 by zaelgohary · 0 comments

zaelgohary commented

2026-02-11 10:13:23 +00:00

Member

Location: mycelium/src/dns.rs - forward_dns_fallback

Problem: When no overlay routes exist, resolver forwards to 1.1.1.1. Raw UDP from [::]:0 to IPv4 may fail on macOS. Using ResolverConfig::cloudflare() includes IPv6 nameservers (2606:4700:4700::1111); on networks with broken IPv6, the resolver tries IPv6 first and times out (~5s) before falling back to IPv4.

Symptom: dig @127.0.0.1 example.com returns SERVFAIL or times out; dig @1.1.1.1 example.com works directly.

Fix: Use IPv4-only nameservers (1.1.1.1, 1.0.0.1) via NameServerConfigGroup::from_ips_clear with filtered CLOUDFLARE_IPS. Set ResolverOpts::timeout to 2 seconds for faster failover.

**Location**: `mycelium/src/dns.rs` - `forward_dns_fallback` **Problem**: When no overlay routes exist, resolver forwards to 1.1.1.1. Raw UDP from `[::]:0` to IPv4 may fail on macOS. Using `ResolverConfig::cloudflare()` includes IPv6 nameservers (2606:4700:4700::1111); on networks with broken IPv6, the resolver tries IPv6 first and times out (~5s) before falling back to IPv4. **Symptom**: `dig @127.0.0.1 example.com` returns SERVFAIL or times out; `dig @1.1.1.1 example.com` works directly. **Fix**: Use IPv4-only nameservers (1.1.1.1, 1.0.0.1) via `NameServerConfigGroup::from_ips_clear` with filtered `CLOUDFLARE_IPS`. Set `ResolverOpts::timeout` to 2 seconds for faster failover.