Node making unnecessary AAAA DNS queries

[peterfour]

I've been noticing some weird issue on my cluster.

I have an 8 nodes with 3 control plane cluster, and the endpoint is balanced using a triple A record in my dns
However I've been noticing a flood (1 every second/few seconds) of AAAA query for the endpoint domain, even though the nodes don't have an ipv6 address.
I'm not sure what is making the queries but they originate from all the nodes.

Something that might be related as well is the resolver-cache sometimes output a bunch of timeout issues like those :

user: warning: [2026-03-10T09:59:58.800647702Z]: [talos] error serving dns request {"component": "dns-resolve-cache", "error": "read udp 10.2.1.1:36031->10.2.2.3:53: i/o timeout"}

After looking into it a bit more it might be related to the resolver cache, doing the queries as this log shows :

10.2.1.3: 2026-03-10T13:15:07.976Z DEBUG dns response {"component": "dns-resolve-cache", "data": ";; opcode: QUERY, status: NOERROR, id: 53928\n;; flags: rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;kube.example.net.\tIN\t AAAA\n", "proto": "udp", "question": "kube.example.net.", "local_addr": "127.0.0.53:53", "remote_addr": "127.0.0.1:52388", "data": ";; opcode: QUERY, status: NOERROR, id: 53928\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;kube.example.net.\tIN\t AAAA\n\n;; AUTHORITY SECTION:\nexample.net.\t82743\tIN\tSOA\tns.example.net. tech.example.net. 2025121500 3600 1800 604800 86400\n"}

If you could help me figure out how to reduce the dns noise that would be great

[smira]

The Host DNS is passive in the sense it just routes incoming requests, it doesn't do any type of requests on its own.

Applications will often default to do IPv6/IPv4 concurrent resolving and trying the path which works first (https://en.wikipedia.org/wiki/Happy_Eyeballs). All machines by default have IPv6 enabled, and have link-local IPv6 addresses.

So I don't think there is anything to be concerned about, the only workaround might be to disable IPv6 completely, but this will break many other good things like KubeSpan.

[peterfour]

Hum yeah that was my worry, ideally I don't want to break stuff by disabling ipv6. But my concern is that it's trying AAAA requests constantly, surely when it's getting a NODATA it should no retry for a while ?

Weirdly it seems that domain and only that one is suffering from the massive amount of queries see the table :

[smira]

What should not retry? DNS queries are sent by applications, not by DNS cache. Negative TTL cache is relatively short to allow for retries.

[peterfour]

I'm still not sure what is making the query to that kube endpoint, but the negative ttl should be 86400 and it clearly not the case if the query is made every second. The A record is cached properly for an hour, but the client doesn't seem to honour the Negative TTL

[peterfour]

Right so for future reference, this wasn't related to talos at all I think (it was probably kubelet making the queries), but after adding a dummy AAAA record, the number of queries fell of a cliff 🎉

[peterfour]

Indeed I can see that the resolver cache is defaulting the NegativeTTL to 5 seconds. I wrongly assumed it was to be following the upstream value.

https://github.com/siderolabs/talos/blob/main/internal/pkg/dns/dns.go#L43