<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">Dear Alex.</div><div class=""><br class=""></div><div class="">Thanks for the tip. Please check full log at <a href="https://pastebin.com/JmdS6Sw5" class="">https://pastebin.com/JmdS6Sw5</a> .</div><div class=""><br class=""></div><div class="">In this attempt, I tried to visit google. In this case lan dns could not provide a correct dns reply, but provided a No Such Domain reply instead. </div><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Jan 13, 2026, at 9:48 AM, Alex Rousskov <<a href="mailto:rousskov@measurement-factory.com" class="">rousskov@measurement-factory.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On 2026-01-12 20:22, Archer wrote:<br class=""><br class=""><blockquote type="cite" class="">I picked up this part of log as evidence that Squid does conduct DNS lookups AFTER a peer connection is selected( log ommited). In the configuration, a cache peer (parent proxy) for specified domains presents.<br class="">And the relative part of config is already provided in some other thread of this post. TY<br class=""></blockquote><br class=""><br class="">FWIW, if I have access to a full debugging log collected while reproducing the problem, I may be able to tell you what causes DNS lookups in your specific environment. I discourage Squid admins from studying debugging logs because they are meant for Squid developers and can be very misleading.<br class=""><br class=""><a href="https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-transaction" class="">https://wiki.squid-cache.org/SquidFaq/BugReporting#debugging-a-single-transaction</a><br class=""><br class="">Without looking at the logs, and without investing a lot of time in trying to reproduce the problem locally based on the partial information you have shared, I can only offer guesses, and I have done that already.<br class=""><br class="">Alex.<br class=""><br class=""><br class=""><blockquote type="cite" class="">On 2026-01-09 17:19, archer wrote:<br class=""><blockquote type="cite" class="">cache_peer a.b.c.d parent ... name=NodeNG<br class="">always_direct extranet_whitelist<br class="">never_direct extranet<br class=""></blockquote><blockquote type="cite" class="">I observed peer-select.cc still conducting DNS lookups on an extranet domain , which is a purely domain-based ACL. e.g.<br class=""><br class="">peer_select.cc(833) selectSomeParent: CONNECT www.example.com<br class="">...<br class="">peer_select.cc(460) resolveSelected: Find IP destination for: www.example.com:443 via a.b.c.d<br class=""></blockquote>The above debugging log snippet is unrelated to ACLs checking/code.<br class="">Squid says that it needs to resolve a.b.c.d to connect to a peer at that a.b.c.d address. If a.b.c.d is alerady an IP address, then that resolution is going to be a no-op -- no actual DNS queries will be sent.<br class="">I do not know what triggers other DNS queries in your case. If I have to guess, I would guess that peer selection algorithm finds multiple ways to satisfy that CONNECT-to-X request and some of those ways include a direct connection to X, triggering X resolution.<br class=""><blockquote type="cite" class="">So, what can I do to have extranet DNS handled by the parent proxy, while leaving the remainder to the child proxy, with a domain list ?<br class=""></blockquote><blockquote type="cite" class="">Squid Cache: Version 5.7<br class=""></blockquote>FWIW, the above version is not supported by the Squid Project.<br class="">Alex.<br class=""></blockquote><br class=""></div></div></blockquote></div><br class=""></body></html>