The work-around did not work for me. I couldn't get the host command to wait with -W 5 and didn't try shell wait. I use dnssec-trigger, a validating resolver, which may have something to do with it. I also added '-N 2' to host for better domain parsing and set my domain in /etc/resolv.conf (in dnssec-trigger.conf, in my case).
I believe systemd will eventually make this better. For now, I tried the Required-Start boot facility to have nslcd depend on dnsssec-trigger, but that did not work. Some kind of retry interplay between k5start and nslcd might also be useful.
