Resolver Priority
Add one line to a file on your disk and ping app.example answers with the address you picked. Run dig app.example right after and it ignores that line entirely, going straight to the network instead.
- ▸The same hostname can resolve two different ways on one machine, depending on which tool asks.
- ▸A name in your local table never reaches a DNS server; the lookup stops before the network.
- ▸One bracket on one line is the difference between a
.localname staying home and leaking to your ISP.
getaddrinfo("app.example") is the call almost every program makes to turn a name into an address, and before it sends a single DNS query it opens a config file. On glibc Linux that file is /etc/nsswitch.conf, and the line that matters starts with hosts:. That line is an ordered list of places to look, read strictly left to right. A minimal one reads hosts: files dns: try the files source first, and only if it has no answer, try dns, the resolver chain from the last topic.
The mechanism is a walk. The Name Service Switch hands the name to the first source; if that source returns an address, the walk stops and that address is the answer, no later source is consulted. If the first source has nothing, control passes right to the next token. So localhost, which the files source answers, never reaches dns at all, while a public name like app.example, which files does not know, falls through to dns on the right.
Real distros put more tokens on this line than two, and we add them a part at a time. What stays fixed is the rule: the order of the tokens is the order of the search, and the first source with an answer wins.