Firefox uses an internal cache for DNS lookups. You can see the firefox resolver in action by running firefox on the command line with: $ NSPR_LOG_MODULES=nsHostResolver:5 firefox All NSPR log modules are defined in the source code by a PRLogModuleInfo struct. You can search for this to find other modules that are log enabled in firefox. So when you start up firefox it will hit nscd with a lot of DNS lookups which are very likely not cached.
Coccinelle: Finding bugs in open source systems code – YouTube.