dovecot - Apr 2019 - failed: read(/var/run/dovecot/dns-client)

==dsync(foobar at example.com): Error: imapc(foobar.example.com:993):
dns_lookup(foobar.example.com) failed: read(/var/run/dovecot/dns-client) failed:
read(size=512) failed: Connection reset by peer

dsync(foobar at example.com): Error: Failed to initialize user: imapc: Login to
foobar.example.com failed: Disconnected from server
==
Initially I thought "oh no, not another AppArmor block".

But then surely the second message would not appear if the DNS lookup was not
successful ?

Also "dig foobar.example.com" works fine.

How should I be troubleshooting this ?  And if it is still likely to be
AppArmor, what is calling it ? "doveadm" itself or something else ? 
What does "/var/run/dovecot/dns-client" do and why doesn't dovecot
use standard OS calls like everyone else ?

So many questions !

> On 10 April 2019 21:26 Laura Smith via dovecot <dovecot at
dovecot.org> wrote:
> 
>  
> ==> dsync(foobar at example.com): Error: imapc(foobar.example.com:993):
dns_lookup(foobar.example.com) failed: read(/var/run/dovecot/dns-client) failed:
read(size=512) failed: Connection reset by peer
>
This is dovecot's internal dns-client, and something goes wrong when talking
to the service.
 
> dsync(foobar at example.com): Error: Failed to initialize user: imapc:
Login to foobar.example.com failed: Disconnected from server
This is btw dsync service, not imap service.
> ==> 
> Initially I thought "oh no, not another AppArmor block".
> 
> But then surely the second message would not appear if the DNS lookup was
not successful ?
> 
> Also "dig foobar.example.com" works fine.
> 
> How should I be troubleshooting this ?  And if it is still likely to be
AppArmor, what is calling it ? "doveadm" itself or something else ? 
What does "/var/run/dovecot/dns-client" do and why doesn't dovecot
use standard OS calls like everyone else ?
> 
Because the "standard OS call" is blocking and we would prefer it to
not block everything else.
> So many questions !
Aki

On Wednesday, April 10, 2019 7:57 PM, Aki Tuomi <aki.tuomi at
open-xchange.com> wrote:
> > On 10 April 2019 21:26 Laura Smith via dovecot dovecot at dovecot.org
wrote:
> > ==> > dsync(foobar at example.com): Error:
imapc(foobar.example.com:993): dns_lookup(foobar.example.com) failed:
read(/var/run/dovecot/dns-client) failed: read(size=512) failed: Connection
reset by peer
>
> This is dovecot's internal dns-client, and something goes wrong when
talking to the service.
>
> > dsync(foobar at example.com): Error: Failed to initialize user: imapc:
Login to foobar.example.com failed: Disconnected from server
>
> This is btw dsync service, not imap service.
>
> > ==> > Initially I thought "oh no, not another AppArmor
block".
> > But then surely the second message would not appear if the DNS lookup
was not successful ?
> > Also "dig foobar.example.com" works fine.
> > How should I be troubleshooting this ? And if it is still likely to be
AppArmor, what is calling it ? "doveadm" itself or something else ?
What does "/var/run/dovecot/dns-client" do and why doesn't dovecot
use standard OS calls like everyone else ?
>
> Because the "standard OS call" is blocking and we would prefer it
to not block everything else.
>
> > So many questions !
>
> Aki

Thanks for your reply, but both those message are generated from a simple :
doveadm -v -o mail_fsync=never backup -R -u foobar at example.com imapc:

So I don't know what you mean about dsync service failing ?  Surely the DNS
lookup succeeded if the 'dsync service' failed due to remote disconnect
?

I'm still none the wiser as to where to start looking for troubleshoting ?