>> Also, does this code work correctly if resolv.conf is a symlink?

>open() will follow the symlink, so the kevent filter will watch the target of
>the symlink, not the symlink itself. I can see 2 ways to loose with this:
>- if the symlink doens't point to a real file, and points outside of /etc/
>  in this case, open() will fail, and the kevent will be set on /etc.
>  Then we can recreate a file as the symlink's target, but the resolver won't
>  notice it.
>- if we change the symlink to point to another file.

Is kqueue the right solution then?  How bad would it be to simply
open resolv.conf and fstat it?  You could record the mtime as well as 
the time you last looked and avoid doing so more than once in 
some window.  That would be bog simple and probably not too expensive.

You could also invalidate the handle on certain DNS failures to speed 
things up even with a bigger cycle time for re-checking...

--sjg