GitLab

The dig command line options tries (and therefore also retry, see my !3809 for simplifying this redundance) is not only effective for UDP queries, like said in the man page, but the same way also for TCP queries.

Steps to reproduce:

Setup a firewall rule that drops all traffic to a random IP address that we want to timeout when querying with dig. Here it is 1.2.3.4: iptables -I OUTPUT -d 1.2.3.4/32 -j DROP

Now we query with dig 9.14.8 and +tcp +tries=1:

time dig +tcp +timeout=1 +tries=1 @1.2.3.4 example.com

; <<>> DiG 9.14.8 <<>> +tcp +timeout +tries @1.2.3.4 example.com
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached
;; Connection to 1.2.3.4#53(1.2.3.4) for example.com failed: timed out.

real    0m1,004s

Dig times out after 1 s, as expected with timeout=1s and tries=1.

Now we query with dig 9.14.8 and +tcp +tries=5:

time dig +tcp +timeout=1 +tries=5 @1.2.3.4 example.com
;; Connection to 1.2.3.4#53(1.2.3.4) for example.com failed: timed out.
;; Connection to 1.2.3.4#53(1.2.3.4) for example.com failed: timed out.
;; Connection to 1.2.3.4#53(1.2.3.4) for example.com failed: timed out.
;; Connection to 1.2.3.4#53(1.2.3.4) for example.com failed: timed out.

; <<>> DiG 9.14.8 <<>> +tcp +timeout +tries @1.2.3.4 example.com
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached
;; Connection to 1.2.3.4#53(1.2.3.4) for example.com failed: timed out.

real    0m5,004s

Dig times out after 5 s, as expected with timeout=1s and tries=5.

So, tries sets the timeout also of TCP queries, not only UDP queries.