Merge pull request #580 from datawire/revert-fast-nxdomain

Revert "Replace suffix stripping with fast NXDOMAIN."
This reverts commit dee1fde.
Fixes #578

k8s-proxy/resolver.py

@@ -2,7 +2,6 @@
 from copy import deepcopy
 from typing import Callable, List, Tuple, Optional, Union
 
-from twisted.python.failure import Failure
 from twisted.internet import defer
 from twisted.names import client, dns, error
 from twisted.internet.threads import deferToThread
@@ -168,13 +167,26 @@ def _strip_search_suffix(self, parts):
     def _handle_search_suffix(self, query, parts, timeout):
         stem = self._strip_search_suffix(parts)
         if stem != parts:
-            # This is a query including a search domain from the client's
-            # network context.  The search domain doesn't make sense in the
-            # cluster's network context.  Fail this query fast.
-            print("Fast-failing query with search suffix: {}".format(
-                query.name,
-            ))
-            return Failure(error.DomainError())
+            new_query = deepcopy(query)
+            new_query.name.name = b".".join(stem)
+            print(
+                "Updated query of type {} from {} to {}".
+                format(query.type, query.name.name, new_query.name.name)
+            )
+
+            def failed(f):
+                print(
+                    "Failed to lookup {} due to {}, falling back to {}".
+                    format(new_query.name.name, f, query.name.name)
+                )
+                return self.fallback.query(query, timeout=timeout)
+
+            return defer.maybeDeferred(
+                self.query,
+                new_query,
+                timeout=(1, 1),
+                real_name=query.name.name,
+            ).addErrback(failed)
 
     def query(
         self,

newsfragments/578.bugfix

@@ -0,0 +1,3 @@
+When using the vpn-tcp method, DNS queries from the domain search path no longer yield NXDOMAIN.
+Unfortunately, the expected follow-up query does not occur in some network conditions.
+This change fixes a DNS regression introduced in 0.81.