How does OpenSSH / NSS determine the address to use for a hostname with multiple DNS entries?

Solution 1:

How does OpenSSH / NSS determine the address to use for a hostname with multiple DNS entries?

getaddrinfo() the libc name resolver. Every address resolved is attempted, see sshconnect.c

ssh_config is sometimes useful as a crude name resolver because HostName real name keywords can go under Host or Match blocks. Problem is, I don't know of a way to modify these without duplicating the IP addresses. It is not powerful enough to rewrite names any way you like.

glibc allows influence of getaddrinfo sort order via gai.conf. This is not a ssh client config, it would affect glibc name resolution, and almost all software on the system.

Multiple DNS records of the same name, only one of which works to connect, is causing problems. Alter DNS such that there is a name that can be used for SSH. For example, renaming one of those zones such that the full name is unqiue, say my-weird-AD-device.zone.company.com. Or, add an additional short name to DNS for this host with only the correct IP, so my-weird-AD-device-2.