2026.10.67 — 2026-10-31

Fixed

• Answer a reverse lookup with the address, and stop blaming advertised listeners (c02f5b7e)

  A SASL connection to a Kafka cluster that is reachable and authenticates from kcat and the Kafka CLI failed from Rahdar with "Brokers advertise addresses Rahdar cannot reach. The call's deadline passed", although the brokers advertised exactly the bootstrap addresses.

  Kafka builds a SASL channel by naming the socket's peer, and Java answers that with a PTR query first. On a network whose subnets have no reverse zone each query times out: measured at 5-10 s per broker here, once per broker per connection attempt, all on Kafka's single I/O thread. Kafka charges that wait to socket.connection.setup.timeout.ms, which this release had set to the 3 s TCP connect timeout, so every attempt was cut off before it read an API version. The value the lookup would have produced on timeout is the address text itself, so NumericReverseDns returns that at once: forward lookups still go to the system resolver, and no TLS host-name check or bootstrap resolution depends on a PTR record.

  The check also classifies the result. ADVERTISED_UNREACHABLE now needs the failure to be on an address the cluster reported, which the driver puts in the error metadata, rather than on one of the bootstrap servers the check was given; when the brokers advertise those, nothing was advertised that could not be reached. The same relayed SASL failure is AUTHENTICATION. The timeout advice names the two things that actually overrun connection setup, a reverse DNS with no zone and a login waiting on a policy server.

  Verified on the affected deployment: the same request returns ADVERTISED_UNREACHABLE on 2026.10.66 and AUTHENTICATION on this build, which reaches the broker and runs SCRAM.