Some tuning possible here ?

[reinerotto]

Having closer look at my logfile (sslh-fork 2.2.4), I see:
....
#Incoming connection is from a socks5-client, to local socks5-server, listening on port 8388:
hexdump of incoming packet:
0x000000: 05 01 02 ...
probing for tls
probed for tls: PROBE_AGAIN
probing for socks5
probed for socks5: PROBE_MATCH #Correct
trying to connect to localhost:8388 family 10 len 28 #Why family 10 ???? 3rd byte indicates family 2 (common USR/PWD auth).
forward to socks5 failed:connect: Connection refused #Of course.
trying to connect to localhost:8388 family 2 len 16 #This test should be first (or only) try, not second
sprintaddr:getnameinfo: Temporary failure in name resolution #???? How come ? nslookup domina.com works

There is no apparent bug/issue when using actual code, But I think, switching the try to connect could have
some small positive performance impact. OR testing for family 10 could be dropped, completely.

[yrutschle]

The 'family' in the logs is the socket address family, with 10 being IPv6 and 2 IPv4.
If the '3rd byte' you mention is in the hexdump, that's the payload of the TCP connection that is used for the probing, so that cannot give you any information on the socket family.

My guess is that localhost resolves to IPv6 and IPv4 (which is pretty standard), it tries to connect to localhost with IPv6 and fails, then I get a bit confused with name resolution failing on localhost (unexpected) (do you have resolve_on_forward on?), me not understanding why you are talking about domina.com, then saying it works. Which one is it? :-)

If there is something wrong, please post your configuration file, the logs, what you are trying to achieve, and what you would expect happens.

[reinerotto]

I have to apolodgize, I completely misinterpreted the log-info.
... The 'family' in the logs is the socket address family, with 10 being IPv6 and 2 IPv4. ...
This clarifies a lot.
In fact, there was a line in /etc/hosts:
::1 localhost ip6-localhost ip6-loopback
After removal of this line (no IPv6 in use)
trying to connect to localhost:8388 family 10 len 28
disappeared from log.

nslookup domina.com works: Typo. To read instead: nslookup domain.com works. But irrelevant now.

Only this msg persists in log:
sprintaddr:getnameinfo: Temporary failure in name resolution

Actual sslh.cfg:

timeout: 2;
user: "nobody";
pidfile: "/var/run/sslh.pid";
listen:
(
{ host: "1.2.3.4"; port: "443"; }
);
protocols:
(
{ name: "tls"; host: "127.0.0.1"; port: "443"; log_level: 0; tfo_ok: true; resolve_on_forward: false; },
{ name: "socks5"; host: "127.0.0.1"; port: "8388"; log_level: 0; tfo_ok: true; resolve_on_forward: false; },
{ name: "anyprot"; host: "127.0.0.1"; port: "443"; tfo_ok: true; resolve_on_forward: false; }
);

Omitting "resolve_on_forward: false;" makes no difference, also getting
sprintaddr:getnameinfo: Temporary failure in name resolution