Starting a named container or VM blocks systemd-resolved from resolving an entire TLD with that name

systemd version the issue has been seen with

261.2

Used distribution

Fedora 45 Beta

Linux kernel version used

7.2.0-61.fc45.x86_64

CPU architectures issue was seen on

x86_64

Component

machinectl, systemd-nspawn, systemd-resolved

Expected behaviour you didn't see

When I start a container or VM with machine name ai, I should still be able to resolve globally registered .ai domains such as www.nic.ai.

(Why? There are over 1500 registered TLDs, and even if I select a machine name that doesn’t conflict with a globally registered TLD at present, there’s no guarantee it won’t do so in the future.)

Unexpected behaviour you saw

I can no longer resolve www.nic.ai.

Steps to reproduce the problem

On a freshly booted Fedora 45 Beta live CD (problem does not reproduce on Fedora 44):

$ resolvectl query www.nic.ai
www.nic.ai: 34.149.87.45                       -- link: enp1s0
            (td-ccm-neg-87-45.wixdns.net)

-- Information acquired via protocol DNS in 69.4ms.
-- Data is authenticated: no; Data was acquired via local or encrypted transport: no
-- Data from: cache network
$ sudo dnf install --assumeyes --installroot=/var/lib/machines/ai --use-host-config @core
$ sudo systemctl start systemd-nspawn@ai
$ resolvectl query www.nic.ai
www.nic.ai: Name 'www.nic.ai' not found

If I do resolvectl log-level debug before starting the container, journalctl shows the log message below referencing {"filterDomains":["ai"]}, suggesting that something blocked the entire domain deliberately. If so, this is not a good design, for the reason described above.

Additional program output to the terminal or log subsystem illustrating the issue

Sep 16 22:27:04 localhost-live systemd-resolved[1171]: Found new link 4/ve-ai
Sep 16 22:27:04 localhost-live systemd-resolved[1171]: hook-io.systemd.Machine: Received message: {"parameters":{"filterDomains":["ai"]},"continues":true}
Sep 16 22:27:04 localhost-live systemd-resolved[1171]: hook-io.systemd.Machine: Changing state awaiting-reply-more → processing-reply
Sep 16 22:27:04 localhost-live systemd-resolved[1171]: hook-io.systemd.Machine: Changing state processing-reply → awaiting-reply-more

Start by reproducing the issue with machinectl/systemd-nspawn and systemd-resolved using the commands in the report, then trace how the container's filterDomains message reaches resolved. Compare the behavior with and without a machine named ai. Done means the container starts while globally registered .ai domains such as www.nic.ai remain resolvable.