3

I have a Bind Version as shown below

9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6.1.2

I have two Domain Specific Forwarders namely test.example.com and internal-test.example.cloud.com

The Local DNS Client or Resolver who need to resolve certian cname in the DOmain "test.example.com" would be forwarded by my Local DNS Server to the forwarders configured and their responce are cachedalso. Everything works great, no problem. However, my question is the for the Fordwared query, the External DNS Server are replying with a TTL value of 60. So my Internal DNS Server is caching that responce only for 60 Seconds. Is there any means to Override the TTL from my Internal DNS Server ?? for that Specific Domain.

And the /etc/named.conf Looks as following

options {
        directory "/var/named";
        allow-transfer{"none";};
        allow-query {localhost; any;};
        dump-file "/var/log/named_dump.db";
        max-cache-ttl 300;
};

zone "test.example.com" IN {
        type forward;
        forwarders {11.1.2.17; 11.1.3.59;};
        forward only;
};

zone "internal-test.example.cloud.com" IN {
        type forward;
        forwarders {11.1.2.17; 11.1.3.59;};
        forward only;
};

zone "domain.local" in {
    type master;
    file "domain.local";
};



[root@dchockal ~]# dig test.example.com
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6.1.2 <<>> test.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31197
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;test.example.com.   IN      A

;; ANSWER SECTION:
test.example.com. 60 IN      CNAME   internal-test.example.cloud.com.
internal-test.example.cloud.com. 60 IN A 121.1.2.22
internal-test.example.cloud.com. 60 IN A 121.1.2.23
internal-test.example.cloud.com. 60 IN A 121.1.4.24
internal-test.example.cloud.com. 60 IN A 121.1.4.25

;; Query time: 133 msec
;; SERVER: 11.4.152.28#53(11.4.152.28)
;; WHEN: Thu Dec 15 15:31:22 2016
;; MSG SIZE  rcvd: 175
1

I don't think BIND has that functionality - only decreases in TTL (cache-max-ttl), not increases (cache-min-ttl doesn't seem to work on my BIND, but you could give it a whirl and see if it does for your version). But we could create an authoritative domain of our own. After doing so, we could then create a CNAME record in that domain for the external domain.

test.mydomain.com CNAME test.example.com.

Then, the query for test.mydomain.com resolves to the IP address of test.example.com, and the TTL can be configured as desired.

Theoretically, we could rewrite a zone that BIND caches and then create it as a local zone file, set the TTL, and restart BIND; but, that's awful hack.

The software dnsmasq has an option, --min-cache-ttl=<time>, where time is less than or equal to 3600 seconds. The manual has a warning.

--min-cache-ttl=<time>

Extend short TTL values to the time given when caching them. Note that
artificially extending TTL values is in general a bad idea, do not do it
unless you have a good reason, and understand what you are doing. Dnsmasq
limits the value of this option to one hour, unless recompiled.

Your question reads as though you know what you doing. Unbound has the feature as well.

cache-min-ttl: <seconds>

Time to live minimum for RRsets and messages in the cache. Default is 0.
If the minimum kicks in, the data is cached for longer than the domain owner
intended, and thus less queries are made to look up the data. Zero makes sure the
data in the cache is as the domain owner intended, higher values, especially more
than an hour or so, can lead to trouble as the data in the cache does not match
up with the actual data any more.

Perhaps replace BIND with Unbound or dnsmasq, or else use one of them as a forwarder to BIND.

  • Thanks you so much for suggestion. :-) Let me try the dnsmasq /unbound. – Duraivelanc Chockalingam Dec 16 '16 at 11:43
  • Do you know, why " max-cache-ttl seconds;" Option is not working as expected! in Bind – Duraivelanc Chockalingam Dec 18 '16 at 11:27
2

BIND cannot do that and it's not seen as good practice. But perhaps you can update to BIND 9.10.4? In this case, you could use the prefetch-option. That would force BIND to renew cache data on frequently used domains shortly before their TTL expires (can probably be used for specific zones, but I cannot test that since this version of BIND is not yet available on Raspbian). More on the option can be found here:

https://serverfault.com/questions/536952/bind9-how-to-automatically-refresh-entry-after-entry-expires

For example,

options {
  ...
  prefetch 2 9;
};

would force a cache update on any domain that is currently in cache, queried within the last 2 seconds of its TTL and generally has a TTL of more than 9 seconds.

By the way: If you update, make sure it's right to BIND 9.10.4. The prefetch-mechanism was introduced in 9.10, but there was an ugly bug that was was fixed only from 9.10.4 onwards:

https://kb.isc.org/article/AA-01315/0/prefetch-performance-in-BIND-9.10.html

  • Does this answer how to override a short TTL? I don't understand the benefit in relation to the question. – Christopher Dec 16 '16 at 19:07
  • No it doesn't but it explains that what the questioner asks cannot be done in the software he uses (BIND). It also shows a way to prolong keeping entries in cache that would otherwise expire when their TTL runs out; this could help him achieve a similar result using another way than altering the TTL. – Nick Dec 16 '16 at 20:56
  • Ah... I see. Thanks. This could eliminate potential lookup latencies. – Christopher Dec 16 '16 at 21:01
  • Thanks Nick! Do you know, why " max-cache-ttl seconds;" Option is not working as expected! in Bind – Duraivelanc Chockalingam Dec 18 '16 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.