<div>Hi, I am hoping to learn more about how BIND v 9.7.0 implements negative caching of</div><div>delegated subdomains. I've tested and found that BIND observes a different TTL for</div><div>name errors than I would expect it to abide by, but that could be my lack</div>
<div>of understanding of what TTL a DNS server is supposed to abide by in this situation.</div><div><br></div><div>(I've changed the actual domain names as they are only used in our internal network and</div><div>you can't get to it from the internet anyway.)</div>
<div><br></div><div>We have <a href="http://abc.com" target="_blank">abc.com</a> that BIND 9.7.0 is authoritative for.</div><div>And in named.hosts of (host: <a href="http://bind1.abc.com" target="_blank">bind1.abc.com</a>), we have:</div>
<div><br></div>
<div>xyz 30 IN NS <a href="http://dns1.abc.com" target="_blank">dns1.abc.com</a>.</div><div>xyz 30 IN NS <a href="http://dns2.abc.com" target="_blank">dns2.abc.com</a>.</div><div><br>
</div><div><br></div><div>On <a href="http://bind1.abc.com" target="_blank">bind1.abc.com</a>, if you query for a host that doesn't exist, this is dig's output:</div>
<div>> dig <a href="http://nohost.xyz.abc.com" target="_blank">nohost.xyz.abc.com</a> @<a href="http://bind1.abc.com" target="_blank">bind1.abc.com</a></div><div>; <<>> DiG 9.3.5-P1 <<>> <a href="http://nohost.xyz.abc.com" target="_blank">nohost.xyz.abc.com</a> @<a href="http://bind1.abc.com" target="_blank">bind1.abc.com</a></div>
<div>;; global options: printcmd</div><div>;; Got answer:</div><div>;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 1298</div><div>;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0</div>
<div><br></div><div>;; QUESTION SECTION:</div><div>;<a href="http://nohost.xyz.abc.com" target="_blank">nohost.xyz.abc.com</a>. IN A</div><div><br></div><div>;; AUTHORITY SECTION:</div><div><a href="http://xyz.abc.com" target="_blank">xyz.abc.com</a>. 10800 IN SOA localhost. <a href="http://admin.abc.com" target="_blank">admin.abc.com</a>. 1 60 3600 604800 3600</div>
<div><br></div><div>From my tests, Bind is observing the '10800' TTL for <a href="http://nohost.xyz.abc.com" target="_blank">nohost.xyz.abc.com</a>, not '3600' that's </div><div>in the SOA minimum field.</div>
<div><br>
</div><div>The question is why is the TTL of the SOA record used for caching negative answers, not</div><div>the TTL in the SOA minimum field?</div><div><br></div><div>Reading <a href="http://www.dns.net/dnsrd/rfc/rfc2308.html" target="_blank">http://www.dns.net/dnsrd/rfc/rfc2308.html</a>, it says:</div>
<div><br></div><div>"Name servers authoritative for a zone MUST include the SOA record of the zone in the </div><div>authority section of the response when reporting an NXDOMAIN or indicating that no data </div><div>
of the requested type exists. This is required so that the response may be cached. </div><div>The TTL of this record is set from the minimum of the MINIMUM field of the SOA record </div><div>and the TTL of the SOA itself, and indicates how long a resolver may cache the negative answer."</div>
<div><br></div><div>And that doesn't seem clear to me, as TTL of the negative response is cached from BOTH the </div><div>minimum field and the TTL of the SOA record? </div><div><br></div><div>But in Bind, it seems like it's taking the TTL of the SOA. If anyone has an explanation to this, </div>
<div>please chime in. thanks.</div><div><br></div><div>AJ</div>