OpenWrt by default enables the --domain-needed option of dnsmasq, which blocks forwarding of queries with one component. You can turn it off at Network → DHCP and DNS → General Settings → Domain required.
However, systemd-resolved may refuse to resolve such queries anyway: https://github.com/systemd/systemd/issues/8967. There’s apparently a ResolveUnicastSingleLabel option to allow them.
Thanks for the heads-up. I've only been running OpenWRT for a couple of weeks and did not know about that.
I tried turning that setting off, and I saw the same behavior. But if I change /etc/resolv.conf to point to the OpenWRT box directly:
#nameserver 127.0.0.53
nameserver 192.168.1.1
It works, so the OpenWRT box seems to be doing the Right Thing now. I guess systemd-resolved is likewise doing something weird with these one-component names. Huh.
EDIT:
Found the corresponding systemd-resolved issue. See here:
Yes, in an earlier HN thread I remember belatedly tracking down and being disappointed by this behavior. It wrongly led me to believe for a moment that the A record itself had been removed!
As a quick warning to other Linux users, if you're using a Linux system you may well not be able to resolve single-component DNS names with your OS-default DNS settings at all, even when they're valid in the global DNS.
For me, before changing that setting, lookups for ai. were failing. After changing it, they worked. I also had to make that OpenWRT change mentioned above since my router is running OpenWRT.
As to the question of whether or not lookup for ai. should work even without that setting... I dunno. Maybe it's just down to the way the systemd-resolved maintainers interpreted the spec?
> As recommended by IETF standards track RFCs, existing deployed systems apply a search list to single-label names prior to attempting to resolve them.
Note that it says "prior to" rather than "instead of". This is a reason not to use them from an operators POV, not a reason to block them.
> most users entering single-label names want them to be resolved in a local context
Most users have absolutely no idea how any of this works.
> These include causing traffic intended for local services to be directed onto the global Internet
I've never experienced any system that applies the search list after trying the label by itself.
> The IAB therefore feels compelled to state the following:
Each of their statements apply to people who would operate these domains, not to users blocking them.
However, systemd-resolved may refuse to resolve such queries anyway: https://github.com/systemd/systemd/issues/8967. There’s apparently a ResolveUnicastSingleLabel option to allow them.
Note that there are a number of reasons you might want these queries to remain blocked: https://www.iab.org/documents/correspondence-reports-documen...