Override TTL Setting External DNS Records

Question

I have a Bind Version as shown below

9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6.1.2

I have two Domain Specific Forwarders namely test.example.com and internal-test.example.cloud.com

The Local DNS Client or Resolver who need to resolve certian cname in the DOmain "test.example.com" would be forwarded by my Local DNS Server to the forwarders configured and their responce are cachedalso. Everything works great, no problem. However, my question is the for the Fordwared query, the External DNS Server are replying with a TTL value of 60. So my Internal DNS Server is caching that responce only for 60 Seconds. Is there any means to Override the TTL from my Internal DNS Server ?? for that Specific Domain.

And the /etc/named.conf Looks as following

options {
        directory "/var/named";
        allow-transfer{"none";};
        allow-query {localhost; any;};
        dump-file "/var/log/named_dump.db";
        max-cache-ttl 300;
};

zone "test.example.com" IN {
        type forward;
        forwarders {11.1.2.17; 11.1.3.59;};
        forward only;
};

zone "internal-test.example.cloud.com" IN {
        type forward;
        forwarders {11.1.2.17; 11.1.3.59;};
        forward only;
};

zone "domain.local" in {
    type master;
    file "domain.local";
};



[root@dchockal ~]# dig test.example.com
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6.1.2 <<>> test.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31197
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;test.example.com.   IN      A

;; ANSWER SECTION:
test.example.com. 60 IN      CNAME   internal-test.example.cloud.com.
internal-test.example.cloud.com. 60 IN A 121.1.2.22
internal-test.example.cloud.com. 60 IN A 121.1.2.23
internal-test.example.cloud.com. 60 IN A 121.1.4.24
internal-test.example.cloud.com. 60 IN A 121.1.4.25

;; Query time: 133 msec
;; SERVER: 11.4.152.28#53(11.4.152.28)
;; WHEN: Thu Dec 15 15:31:22 2016
;; MSG SIZE  rcvd: 175

Answer 1

BIND cannot do that and it's not seen as good practice. But perhaps you can update to BIND 9.10.4? In this case, you could use the prefetch-option. That would force BIND to renew cache data on frequently used domains shortly before their TTL expires (can probably be used for specific zones, but I cannot test that since this version of BIND is not yet available on Raspbian). More on the option can be found here:

https://serverfault.com/questions/536952/bind9-how-to-automatically-refresh-entry-after-entry-expires

For example,

options {
  ...
  prefetch 2 9;
};

would force a cache update on any domain that is currently in cache, queried within the last 2 seconds of its TTL and generally has a TTL of more than 9 seconds.

By the way: If you update, make sure it's right to BIND 9.10.4. The prefetch-mechanism was introduced in 9.10, but there was an ugly bug that was was fixed only from 9.10.4 onwards:

https://kb.isc.org/article/AA-01315/0/prefetch-performance-in-BIND-9.10.html

Answer 2

I don't think BIND has that functionality - only decreases in TTL (cache-max-ttl), not increases (cache-min-ttl doesn't seem to work on my BIND, but you could give it a whirl and see if it does for your version). But we could create an authoritative domain of our own. After doing so, we could then create a CNAME record in that domain for the external domain.

test.mydomain.com CNAME test.example.com.

Then, the query for test.mydomain.com resolves to the IP address of test.example.com, and the TTL can be configured as desired.

Theoretically, we could rewrite a zone that BIND caches and then create it as a local zone file, set the TTL, and restart BIND; but, that's awful hack.

The software dnsmasq has an option, --min-cache-ttl=<time>, where time is less than or equal to 3600 seconds. The manual has a warning.

--min-cache-ttl=<time>

Extend short TTL values to the time given when caching them. Note that
artificially extending TTL values is in general a bad idea, do not do it
unless you have a good reason, and understand what you are doing. Dnsmasq
limits the value of this option to one hour, unless recompiled.

Your question reads as though you know what you doing. Unbound has the feature as well.

cache-min-ttl: <seconds>

Time to live minimum for RRsets and messages in the cache. Default is 0.
If the minimum kicks in, the data is cached for longer than the domain owner
intended, and thus less queries are made to look up the data. Zero makes sure the
data in the cache is as the domain owner intended, higher values, especially more
than an hour or so, can lead to trouble as the data in the cache does not match
up with the actual data any more.

Perhaps replace BIND with Unbound or dnsmasq, or else use one of them as a forwarder to BIND.