Twenty Seconds of Fanout and One NRPT Rule: The True Culprit of the grokbot Hang, Ten Historic DNS Entries on the TAP Adapters, and the Windows Algorithm of Fast Forward and Slow Reverse

The true culprit of a permanently hung window hid inside a twenty-second DNS reverse lookup — and behind it, an algorithm of Windows that few ever read.

I. The First Cut Missed: Cleaning DNS and an Honest Not Fixed

By plan A the ten historic DNS entries on two disconnected TAP adapters were cleaned first — reasonable housekeeping, but it did not fix the problem (the PTR reverse lookup still took 20.4 seconds). That failure was written into the dispatch as it was, not dressed up as an improvement. The first virtue of troubleshooting is not applying makeup to failures.

II. The True Culprit: The Fanout Algorithm and a Room Full of Adapters

The mechanism dug up next is the treasure of this case: the Windows DNS Client handles reverse (PTR) queries by fanout — the same query goes to every DNS server configured on every adapter, and the client waits for the slowest to return; a forward query returns on the first affirmative answer. That is why only PTR was slow. And the interface list of this machine reads like a small data center: ninja-tun, Tailscale, ZeroTier, Ethernet, two TAP adapters, loopback plus WSL — after the fanout, the slowest one consumed exactly twenty seconds. The Grok Bot window was waiting on a twenty-second reverse lookup, and waited itself into a permanent hang.

III. A Surgical NRPT Rule

The fix used Windows’ own formal mechanism: a single NRPT (Name Resolution Policy Table) rule pinning the .in-addr.arpa reverse zone to one resolver (223.5.5.5), bypassing the fanout. The boundary of the surgery was drawn thin: no Ninja config touched, no system proxy touched, no routes or TUN touched; and the rule’s priority was deliberately set below Tailscale’s own *.100.in-addr.arpa rule so they do not fight. The effect was immediate: the reverse lookup fell from 20,400 milliseconds to 330-470; the main window moved from Responding=False (two minutes of sampled CPU, motionless) to True (sixty-plus seconds sampled, CPU climbing normally), all nine processes back in service. The rollback is one command, and the TAP adapters’ original configuration sits in a backup.

IV. The Tail Awaiting the Master Call

One more interesting tail remains: Grok Bot raised its own update notice — 0.78.1 is the known hang in the forum thread, and 0.78.5 most likely fixed it. If the upgrade lands, even the NRPT rule may become unnecessary. The terminus of a troubleshooting case is sometimes not a patch but the fix the upstream ships itself — whether to upgrade now is the master button. The universal version of this case: when a machine carries a roomful of virtual adapters, fast-forward-and-slow-reverse is the fingerprint of the fanout algorithm, and NRPT is the minimal surgery that wakes nobody else.