Firefox uses an internal cache for DNS lookups. You can see the firefox resolver in action by running firefox on the command line with:

$ NSPR_LOG_MODULES=nsHostResolver:5 firefox

All NSPR log modules are defined in the source code by a


struct. You can search for this to find other modules that are log enabled in firefox.

So when you start up firefox it will hit nscd with a lot of DNS lookups which are very likely not cached.