diff --git a/src/pkg/net/dnsclient_unix.go b/src/pkg/net/dnsclient_unix.go
index eb4b590..dc5eed9 100644
--- a/src/pkg/net/dnsclient_unix.go
+++ b/src/pkg/net/dnsclient_unix.go
@@ -310,13 +310,10 @@
 		}
 		// Can try as ordinary name.
 		cname, addrs, err = tryOneName(cfg.dnsConfig, rname, qtype)
-		if err == nil {
+		if rooted || err == nil {
 			return
 		}
 	}
-	if rooted {
-		return
-	}
 
 	// Otherwise, try suffixes.
 	for i := 0; i < len(cfg.dnsConfig.search); i++ {
@@ -330,15 +327,15 @@
 		}
 	}
 
-	// Last ditch effort: try unsuffixed.
-	rname := name
-	if !rooted {
-		rname += "."
+	// Last ditch effort: try unsuffixed only if we haven't already,
+	// that is, name is not rooted and has less than ndots dots.
+	if count(name, '.') < cfg.dnsConfig.ndots {
+		cname, addrs, err = tryOneName(cfg.dnsConfig, name+".", qtype)
+		if err == nil {
+			return
+		}
 	}
-	cname, addrs, err = tryOneName(cfg.dnsConfig, rname, qtype)
-	if err == nil {
-		return
-	}
+
 	if e, ok := err.(*DNSError); ok {
 		// Show original name passed to lookup, not suffixed one.
 		// In general we might have tried many suffixes; showing