FIN without SERVFAIL on TCP lookup to failing hostnames about unbound

[wcawijngaards]

When I try the rhybar.cz name, it does not fail for me. It gives servfail with the validation failure, but not the TCP failure. For the other name, I get it to respond too slowly, and give this log message (on high verbosity):
debug: tcp took too long, dropped
The newer unbound releases have gradual TCP management, where if the TCP is overloaded, the TCP timeout is reduced. The second name has a nameserver that produces timeouts for queries, and lookups take too long. The TCP connection is dropped. Eventually that would produce a SERVFAIL in cache that then answers quickly until it passes out of the cache, and unbound attempts to look up the data again.
Could it be that the nameserver for the cz name occasionally goes down, and then unbound wants to relookup, but it takes a long time. TCP timeouts are shorter now than they were before (and configurable, I believe), and then it drops the TCP connection.
But 200 ms after the query, that looks like it is the tcp timeout configured with tcp-idle-timeout. That is reduced to 1% and then 0.2% of the configured value, with a minimum of 200ms. Looks like the server is full on TCP and the shorter timeout is used. Meanwhile the lookup is taking long (too long).