Commits on Aug 3, 2026

1. fix(resolved): the fallback resolver is the bug, not the safety net

   00-moshpit.conf assumed systemd-resolved "uses the first server for every
   query, rotating only on failure", so listing DigitalOcean's resolvers
   after the bridge was harmless insurance.
   
   It rotates away from a failing server and does not rotate back. One
   restart of moshpit-dns moves every query to the fallback permanently, and
   the fallback answers NXDOMAIN for every Moshpit name — so DNS looks
   healthy while the whole namespace is dead. That is the worst shape a
   failure can take: nothing is obviously broken to look at.
   
   Seen three times in one afternoon before it was understood. `dig
   @127.0.0.1 -p 5354 seo.rank` answered, `curl seo.rank` did not, and
   resolvectl showed the bridge listed and 67.207.67.3 current.
   
   The fallback also buys nothing. The bridge forwards what it cannot answer
   upstream itself (mode=clearnet), so a second entry adds no capability —
   only that failure. If the bridge stops, restart it: the unit already does,
   in two seconds. Two seconds of no DNS beats an afternoon of DNS that lies.
   
   Documents that this must be the only drop-in setting DNS=, and how to
   remove the others.

   

   ralyodio committed Aug 3, 2026
   Configuration menu

   • View commit details
   • Copy full SHA for abdc45b
   • Browse repository at this point

   Copy the full SHA

   abdc45b View commit details

   Browse the repository at this point in the history