Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

According to many guides I've found, the search domain in /etc/resolv.conf should be used for dotless queries only. However, man resolv.conf says this about the ndots option:

sets a threshold for the number of dots which must appear in a name given to res_query(3) (see resolver(3)) before an initial absolute query will be made. The default for n is 1, meaning that if there are any dots in a name, the name will be tried first as an absolute name before any search list elements are appended to it. The value for this option is silently capped to 15.

This contradicts the claims about search domains being used only for dotless queries, and also seems to be true. I first noticed it by accident using tcpdump. When resolving for example, and my resolv.conf contains 'search', the result is two queries: and Both queries get the NXDOMAIN answer, and resolving seems to work as it should, but is there any way to prevent the latter query? It is obviously bogus and (not 100% sure about this) a potential security risk.

What practical reasons are there anyway for appending the search domain to a fully qualified domain name (or more specifically, a name with at least ndots dots)? I can't think of any. Wouldn't it be better if the resolver just didn't try use the search domain at all when the original query is answered with NXDOMAIN, provided that it had at least ndots dots?

I'm using Debian wheezy. Could the behavior be different on other distributions, or other UNIX-like systems?

share|improve this question

The practical reason for this behaviour is very simple: if your organization uses domain, and its sales department uses domain, then you should be able to access FQDN as simply fileserver.sales. This is really handy if you have many internal hosts/sites, and saves quite a lot of typing.

Note that ndots option is only deals with the initial query, e.g. should be initial query be sent as-is, or with the local domain appended. If the first verbatim query failed, resolver will always append the local domain and try again. This has nothing to do with the number of dots.

Many auto-discovery protocols and services depend on this DNS behaviour. There is no security risk as long as the local domain is under your control. E.g. if somebody types and your local domain is not under your control, it is trivial to set up a rogue server at to intercept these typos.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.