net: In a high latency environment, if the AAAA response contains SOA (i.e., an empty response), the pure Go parser (netdns=go) will return the message "Host not found".

[trend1237]

Go version

go version go1.26.1 linux/amd64

Output of go env in your module/workspace:

AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE=''
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/root/.cache/go-build'
GOCACHEPROG=''
GODEBUG='netdns=cgo'
GOENV='/root/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build1125228400=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/opt/test/go.mod'
GOMODCACHE='/root/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/root/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/opt/test/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/root/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/opt/test/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.1'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

I attempted to resolve a domain in a specific network environment where the application-level DNS latency is significantly higher than the network-level ICMP latency:

Network Latency (ICMP): Low. ping to 180.76.76.76 shows ~20ms.

DNS Application Latency: High. dig @180.76.76.76 registry.example.com shows a query time of ~800ms.

DNS Behavior: The server 180.76.76.76 returns a valid A record but an empty AAAA record containing an SOA record in the Authority Section.

All the privacy data in the log results have been appropriately replaced.

Output of the "dig" command

# dig @180.76.76.76 registry.example.com AAAA

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.16 <<>> @180.76.76.76 registry.example.com AAAA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55577
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;registry.example.com.         IN      AAAA

;; AUTHORITY SECTION:
example.com.           60      IN      SOA     ns1.example.com. admin.example.com. 1773027147 3600 300 1209600 1800

;; Query time: 54 msec
;; SERVER: 180.76.76.76#53(180.76.76.76)
;; WHEN: Thu Apr 02 17:42:13 CST 2026
;; MSG SIZE  rcvd: 108

Reproduction Code:

NetResolvDns.go

package main

import (
        "context"
        "fmt"
        "net"
        "time"
)

func main() {
        // Target domain name
        host := "registry.example.com"

        // Default parser
        resolver := net.DefaultResolver

        fmt.Printf("--- DNS Mode Comparison Test ---\n")
        fmt.Printf("Current environment variables GODEBUG: %s\n", os.Getenv("GODEBUG"))

        for i := 1; i <= 3; i++ {
                fmt.Printf("\nThe %d th attempt:\n", i)
                start := time.Now()

                // LookupHost will respectively call Pure Go or CGO (glibc) in different modes.
                addrs, err := resolver.LookupHost(context.Background(), host)
                duration := time.Since(start)

                if err != nil {
                        fmt.Printf("❌ Analysis failed! Error: %v\n", err)
                } else {
                        fmt.Printf("✅ Analysis successful! IP address: %v\n", addrs)
                }
                fmt.Printf("time-consuming: %v\n", duration)

                time.Sleep(1 * time.Second)
        }
}

What did you see happen?

I ran this test in two modes:

export GODEBUG=netdns=go (Pure Go Resolver)  →  This mode will output: `no such host`

export GODEBUG=netdns=cgo (CGO Resolver)  →  This mode can resolve domain names.

log

The execution result of NetResolvDns.go and the packet capture results obtained through tcpdump are shown in the attachment.

Tech_Report_Go_DNS_Resolver_Anomaly_Analysis_20260402.md

What did you expect to see?

The expected pure Go parser is expected to successfully return IPv4 addresses, which is consistent with the performance of the CGO parser under the same conditions.

The above issue should be consistent with the one discussed in issue #25321

[gabyhelp]

Related Issues

• net: Go's DNS resolver retry AAAA request to next nameserver even A response has records #64783 (closed)
• net: DNS address resolution quirks (AAAA records inconsistency) #25321
• net: pure Go dns does not handle UDP packets > 512 octets #13561 (closed)
• net: BSD: DNS go resolver loses first UDP outbound packet if onlink target not in neighbor cache #43398
• net: netgo dns resolver latency / timeout issues #22406 (closed)
• net: builtin DNS stub resolver returns query results including the second best records unconditionally #11081 (closed)
• net: DNS Lookups Very Slow (netgo) #49253 (closed)
• net: cgo dns resolver doesn't work as expected. #66114 (closed)
• net/http: Client.Do blocks on DNS AAAA record until timeout even after A record succeeds #57697 (closed)
• net: DNS resolver use both A and AAAA queries if only tcp4 network use #71281 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[mateusz834]

Posting the file contents here:

Test results of netdns=go

Execution result of the program

[root@test ~]# export GODEBUG=netdns=go
[root@test ~]# go run NetResolvDns.go
--- DNS Mode Comparison Test ---
Current environment variables GODEBUG: netdns=cgo

The 1 th attempt:
❌ Analysis failed! Error: lookup registry.example.com: no such host
time-consuming: 209.370023ms

The 2 th attempt:
❌ Analysis failed! Error: lookup registry.example.com: no such host
time-consuming: 5.689476ms

The 3 th attempt:
❌ Analysis failed! Error: lookup registry.example.com: no such host
time-consuming: 8.642183ms

Packet capture results

[root@test ~]# tcpdump -i any port 53 -vv -nn -l | grep "registry.example.com"
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
    10.0.14.170.35978 > 180.76.76.76.53: [udp sum ok] 33476+ [1au] AAAA? registry.example.com. ar: . OPT UDPsize=1232 (50)
    10.0.14.170.33425 > 180.76.76.76.53: [udp sum ok] 29861+ [1au] A? registry.example.com. ar: . OPT UDPsize=1232 (50)
    180.76.76.76.53 > 10.0.14.170.33425: [udp sum ok] 29861- q: A? registry.example.com. 1/0/1 . OPT UDPsize=1232 ar: registry.example.com. A x.x.x.x (66)
    180.76.76.76.53 > 10.0.14.170.35978: [udp sum ok] 33476 q: AAAA? registry.example.com. 0/1/0 ns: example.com. SOA ns1.dnsip.com. dnsadmin.dnsip.com. 1773027147 3600 300 1209600 1800 (97)
    10.0.14.170.48004 > 180.76.76.76.53: [udp sum ok] 18270+ [1au] A? registry.example.com. ar: . OPT UDPsize=1232 (50)
    10.0.14.170.59908 > 180.76.76.76.53: [udp sum ok] 44757+ [1au] AAAA? registry.example.com. ar: . OPT UDPsize=1232 (50)
    180.76.76.76.53 > 10.0.14.170.48004: [udp sum ok] 18270- q: A? registry.example.com. 1/0/1 . OPT UDPsize=1232 ar: registry.example.com. A x.x.x.x (66)
    180.76.76.76.53 > 10.0.14.170.59908: [udp sum ok] 44757 q: AAAA? registry.example.com. 0/1/0 ns: example.com. SOA ns1.dnsip.com. dnsadmin.dnsip.com. 1773027147 3600 300 1209600 1800 (97)
    10.0.14.170.58159 > 180.76.76.76.53: [udp sum ok] 38419+ [1au] AAAA? registry.example.com. ar: . OPT UDPsize=1232 (50)
    10.0.14.170.58051 > 180.76.76.76.53: [udp sum ok] 10489+ [1au] A? registry.example.com. ar: . OPT UDPsize=1232 (50)
    180.76.76.76.53 > 10.0.14.170.58051: [udp sum ok] 10489- q: A? registry.example.com. 1/0/1 . OPT UDPsize=1232 ar: registry.example.com. A x.x.x.x (66)
    180.76.76.76.53 > 10.0.14.170.58159: [udp sum ok] 38419 q: AAAA? registry.example.com. 0/1/0 ns: example.com. SOA ns1.dnsip.com. dnsadmin.dnsip.com. 1773027147 3600 300 1209600 1800 (97)

Test results of netdns=cgo

Execution result of the program

[root@test ~]# export GODEBUG=netdns=cgo
[root@test ~]# go run NetResolvDns.go
--- DNS Mode Comparison Test ---
Current environment variables GODEBUG: netdns=cgo

The 1 th attempt:
✅ Analysis successful! IP address: [x.x.x.x]
time-consuming: 7.000717ms

The 2 th attempt:
✅ Analysis successful! IP address: [x.x.x.x]
time-consuming: 31.694998ms

The 3 th attempt:
✅ Analysis successful! IP address: [x.x.x.x]
time-consuming: 5.768931ms

Packet capture results

[root@test ~]# tcpdump -i any port 53 -vv -nn -l | grep "registry.example.com"
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
    10.0.14.170.51734 > 180.76.76.76.53: [udp sum ok] 61239+ A? registry.example.com. (39)
    10.0.14.170.51734 > 180.76.76.76.53: [udp sum ok] 17532+ AAAA? registry.example.com. (39)
    180.76.76.76.53 > 10.0.14.170.51734: [udp sum ok] 61239- q: A? registry.example.com. 1/0/0 registry.example.com. A x.x.x.x (55)
    180.76.76.76.53 > 10.0.14.170.51734: [udp sum ok] 17532 q: AAAA? registry.example.com. 0/1/0 ns: example.com. SOA ns1.dnsip.com. dnsadmin.dnsip.com. 1773027147 3600 300 1209600 1800 (97)
    10.0.14.170.57664 > 180.76.76.76.53: [udp sum ok] 28433+ A? registry.example.com. (39)
    10.0.14.170.57664 > 180.76.76.76.53: [udp sum ok] 11044+ AAAA? registry.example.com. (39)
    180.76.76.76.53 > 10.0.14.170.57664: [udp sum ok] 28433- q: A? registry.example.com. 1/0/0 registry.example.com. A x.x.x.x (55)
    180.76.76.76.53 > 10.0.14.170.57664: [udp sum ok] 11044 q: AAAA? registry.example.com. 0/1/0 ns: example.com. SOA ns1.dnsip.com. dnsadmin.dnsip.com. 1773027147 3600 300 1209600 1800 (97)
    10.0.14.170.56173 > 180.76.76.76.53: [udp sum ok] 35664+ A? registry.example.com. (39)
    10.0.14.170.56173 > 180.76.76.76.53: [udp sum ok] 63075+ AAAA? registry.example.com. (39)
    180.76.76.76.53 > 10.0.14.170.56173: [udp sum ok] 35664- q: A? registry.example.com. 1/0/0 registry.example.com. A x.x.x.x (55)
    180.76.76.76.53 > 10.0.14.170.56173: [udp sum ok] 63075 q: AAAA? registry.example.com. 0/1/0 ns: example.com. SOA ns1.dnsip.com. dnsadmin.dnsip.com. 1773027147 3600 300 1209600 1800 (97)

[mateusz834]

I suspect a malformed DNS packets here.

• Try with https://pkg.go.dev/net#Resolver StrictErrors set to true.
• If you could apply this patch:

diff --git a/src/net/dnsclient_unix.go b/src/net/dnsclient_unix.go
index 53c98f7874..c74ea5f0e5 100644
--- a/src/net/dnsclient_unix.go
+++ b/src/net/dnsclient_unix.go
@@ -15,6 +15,7 @@
 import (
        "context"
        "errors"
+       "fmt"
        "internal/bytealg"
        "internal/godebug"
        "internal/strconv"
@@ -710,6 +711,7 @@
                hitStrictError := false
                for _, qtype := range qtypes {
                        result := responseFn(fqdn, qtype)
+                       fmt.Printf("result: %v %#v\n", qtype, result.error)
                        if result.error != nil {
                                if nerr, ok := result.error.(Error); ok && nerr.Temporary() && r.strictErrors() {
                                        // This error will abort the nameList loop.

and please report back what it prints.

[Emma-Glitch-404]

The issue seems to be a race condition in the pure Go resolver when handling concurrent A and AAAA queries in high-latency environments.
​When the AAAA response takes ~800ms and returns a NOERROR with an empty answer (SOA in authority section), the resolver's logic in dnsclient_unix.go appears to overwrite the valid A record already received. If strictErrors is influenced by this late, empty response, it triggers the 'no such host' error incorrectly.
​Technical Analysis & Proposed Fix
​Based on the investigation of src/net/dnsclient_unix.go, I've identified that the root cause is the unconditional overwrite of lastErr.
​Root Cause
​In high-latency scenarios, the resolver initiates concurrent goroutines. When an A record returns successfully but the subsequent AAAA response arrives late with a NOERROR status and an empty answer, the current logic overwrites the successful result even if addrs already contains data:

// Current logic in dnsclient_unix.go:718
} else if lastErr == nil || fqdn == name+"." {
lastErr = result.error // Overwrites even if addrs already has results
}

Proposed Patch
​The fix involves adding a check for len(addrs) == 0 before allowing lastErr to be overwritten. This ensures that once a valid address is found, subsequent late errors from other query types do not invalidate the lookup.

--- a/src/net/dnsclient_unix.go
+++ b/src/net/dnsclient_unix.go
@@ -715,7 +715,7 @@
// This error will abort the nameList loop.
hitStrictError = true
lastErr = result.error

•   		} else if lastErr == nil || fqdn == name+"." {
  

•   		} else if len(addrs) == 0 && (lastErr == nil || fqdn == name+".") {
    			// Prefer error for original name.
    			lastErr = result.error
    		}
  

This change is minimal, preserves existing error handling for cases where no addresses are found, and correctly handles the race condition by prioritizing available results.