Why does systemd-resolvd fail to transparently query its upstream DNS resolver for short hostnames?

Question

I use dnsmasq to provide DHCP service on my LAN. dnsmasq is also providing DNS service.

When host foo acquires a an IP address via DHCP, dnsmasq will respond to DNS queries for the name foo by providing foo's DHCP-assigned IP address. This can be seens as follows:

$ dig foo @$dnsmasq_ip

; <<>> DiG 9.16.1-Ubuntu <<>> foo @[snip]
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13710
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;foo.                                   IN      A

;; ANSWER SECTION:
foo.                    0       IN      A       192.168.0.[snip]

;; Query time: 0 msec
;; SERVER: 192.168.0.22#53(192.168.0.22)
;; WHEN: Sun May 01 21:03:03 PDT 2022
;; MSG SIZE  rcvd: 51

However, when I do not directly query my dnsmasq server, the DNS query instead goes to systemd-resolved. systemd-resolved responds with SERVFAIL, instead of providing the IP address of foo. This can be seen below. (Note: dnsmasq and dig are running on separate servers, with distinct IP addresses.)

$ dig foo 

; <<>> DiG 9.16.1-Ubuntu <<>> foo
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 13439
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;foo.                                   IN      A

;; Query time: 0 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Sun May 01 21:06:53 PDT 2022
;; MSG SIZE  rcvd: 35

If I dig for a fully qualified domain name, systemd-resolved will query dnsmasq and respond with the result. I believe I have only encountered the above SERVFAIL error when I dig for a short host name.

My question is, why does systemd-resolved fail to transparently relay queries of short hostnames? Is there some way to enable relaying of short hostnames?

Answer 1

systemd-resolved's failure to transparently query short hostnames appears to be a feature. A feature that can be disabled.

Compatibility with the traditional glibc stub resolver

Single-label names are not resolved for A and AAAA records using unicast DNS (unless overridden with ResolveUnicastSingleLabel=, see resolved.conf(5)). This is similar to the no-tld-query option being set in resolv.conf(5).

Source: https://systemd.network/systemd-resolved.service.html

Note: I have not yet verified that ResolveUnicastSingleLabel= actually solves my problem, but it seems likely that it will.