0

I have a corporate DNS server using Bind.
I have 3 consul servers. Consul is listening on localhost port 8660 for DNS. On these servers I have also DNSmasq to forward DNS request from public IP port 53 to Consul on localhost.

The configuration of Consul is very simple. I just activated the DNS port. When I check the DNS locally on port 8660 it is working fine.

The configuration of DNSmasq on each consul server is:

server=/subdomain.example.com/127.0.0.1#8600
server=XX.XX.XX.XX (first ip of the corporate DNS)
server=XX.XX.XX.XX (second ip of the corporate DNS)
listen-address=XX.XX.XX.XX (ip of the server)

The configuration on the corporate DNS is:

zone "subdomain.example.com" {
    type forward;
    forward only;
    forwarders {
        XX.XX.XX.XX; (ip of the first consul)
        XX.XX.XX.XX; (ip of the second consul)
        XX.XX.XX.XX; (ip of the third consul)
    };
};

When some entries are added or removed from consul, the DNS zone on the corporate DNS is updated quite immediately.

When all the entries for a service are deleted from consul, the corporate DNS removed all entries in his table (which is normal). But if the entries are created again, the DNS from consul is updated but not the corporate DNS. To update the corporate DNS, I should execute the command rndc flushtree subdomain.example.com

  • Check the TTL values for the incorrect (cached) entries – roaima Mar 19 at 13:56
0

This is addressed in the Consul doco, under the title "day 1". ☺

Set the soa.min_ttl configuration option. Without it, caching DNS proxies do not know how long "no such name" and "no data" information is supposed to last, and you'll get their own best-effort guesses. This is slightly misrepresented as being the caching DNS proxies' fault. It isn't. A "no such name" and "no data" response datagram is supposed to contain TTL information in a (synthesized) SOA resource record.

Further reading

| improve this answer | |
  • But the default value is 0 for min_ttl so .... it should work without it, no ? – Samuel Mutel Mar 23 at 10:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.