<div dir="ltr"><div><div><div>Hi all,<br><br></div>Currently, I use bind9 as the local dns cache server and a forwarder only server.<br><br></div>I set the dnscrpyt-proxy running on local port 50 as the upstream dns server for my bind9 dns cache server.<br>
<br></div><div>In addtition, I also want to have long TTL so that I can obtain a short inquiry respond time.<br><br></div>For all of the above purposes, I use the following configure file:<br clear="all"><div><div><div><div>
<div><div><div><div><br>-------------------<br>$ cat /etc/bind/named.conf.options<br>options {<br> directory "/var/cache/bind";<br><br> // If there is a firewall between you and nameservers you want<br> // to talk to, you may need to fix the firewall to allow multiple<br>
// ports to talk. See <a href="http://www.kb.cert.org/vuls/id/800113">http://www.kb.cert.org/vuls/id/800113</a><br><br> // If your ISP provided one or more IP addresses for stable <br> // nameservers, you probably want to use them as forwarders. <br>
// Uncomment the following block, and insert the addresses replacing <br> // the all-0's placeholder.<br><br> // forwarders {<br> // 0.0.0.0;<br> // };<br><br> forward only;<br> forwarders {127.0.0.1 port 50 ;} ;<br>
<br> cleaning-interval 1440;<br> max-cache-ttl 2419200;<br> max-ncache-ttl 86400;<br> max-cache-size unlimited;<br> stacksize unlimited;<br> datasize unlimited;<br> coresize unlimited;<br><br> //========================================================================<br>
// If BIND logs error messages about the root key being expired,<br> // you will need to update your keys. See <a href="https://www.isc.org/bind-keys">https://www.isc.org/bind-keys</a><br> //========================================================================<br>
// dnssec-validation auto;<br><br> auth-nxdomain no; # conform to RFC1035<br> listen-on-v6 { any; };<br>};<br>-----------------------<br><br></div><div>Then I restart my dns server with the followoing command to let the above config take in effect:<br>
<br></div><div>sudo service bind9 restart<br><br></div><div>But, I still have low TTL, because I've tried that the following command:<br><br></div><div>----------------<br>werner@debian:~$ dig <a href="http://ssh.sshcenter.info">ssh.sshcenter.info</a><br>
<br>; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> <a href="http://ssh.sshcenter.info">ssh.sshcenter.info</a><br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 676<br>
;; flags: qr rd ra; QUERY: 1, ANSWER: 15, AUTHORITY: 0, ADDITIONAL: 0<br><br>;; QUESTION SECTION:<br>;<a href="http://ssh.sshcenter.info">ssh.sshcenter.info</a>. IN A<br><br>;; ANSWER SECTION:<br><a href="http://ssh.sshcenter.info">ssh.sshcenter.info</a>. 60 IN CNAME <a href="http://c-ssh.cloudkvm.net">c-ssh.cloudkvm.net</a>.<br>
<a href="http://c-ssh.cloudkvm.net">c-ssh.cloudkvm.net</a>. 60 IN A 23.226.226.124<br><a href="http://c-ssh.cloudkvm.net">c-ssh.cloudkvm.net</a>. 60 IN A 69.197.147.93<br><a href="http://c-ssh.cloudkvm.net">c-ssh.cloudkvm.net</a>. 60 IN A 96.44.134.231<br>
<a href="http://c-ssh.cloudkvm.net">c-ssh.cloudkvm.net</a>. 60 IN A 107.150.4.170<br><a href="http://c-ssh.cloudkvm.net">c-ssh.cloudkvm.net</a>. 60 IN A 162.211.227.83<br><a href="http://c-ssh.cloudkvm.net">c-ssh.cloudkvm.net</a>. 60 IN A 173.254.237.179<br>
<a href="http://c-ssh.cloudkvm.net">c-ssh.cloudkvm.net</a>. 60 IN A 192.3.23.197<br><a href="http://c-ssh.cloudkvm.net">c-ssh.cloudkvm.net</a>. 60 IN A 192.161.175.143<br><a href="http://c-ssh.cloudkvm.net">c-ssh.cloudkvm.net</a>. 60 IN A 192.227.161.20<br>
<a href="http://c-ssh.cloudkvm.net">c-ssh.cloudkvm.net</a>. 60 IN A 199.119.224.224<br><a href="http://c-ssh.cloudkvm.net">c-ssh.cloudkvm.net</a>. 60 IN A 199.233.236.200<br><a href="http://c-ssh.cloudkvm.net">c-ssh.cloudkvm.net</a>. 60 IN A 23.90.4.124<br>
<a href="http://c-ssh.cloudkvm.net">c-ssh.cloudkvm.net</a>. 60 IN A 23.92.50.22<br><a href="http://c-ssh.cloudkvm.net">c-ssh.cloudkvm.net</a>. 60 IN A 23.94.104.29<br><br>;; Query time: 1208 msec<br>
;; SERVER: 127.0.0.1#53(127.0.0.1)<br>;; WHEN: Fri Mar 28 14:04:01 2014<br>;; MSG SIZE rcvd: 292<br>--------------------<br></div><div><br></div><div>Though in above query, the query time is 1208 msec, if I immediately do the second query, the query time will be dramtically shorttened. But after several minites, I will still obtain a long query time as the above one. The OS used by me is Debian GNU/Linux 7.4 (wheezy).<br>
<br></div><div>Any hints on this issue?<br><br></div><div>Regards<br>-- <br>Hongyi Zhao <<a href="mailto:hongyi.zhao@gmail.com">hongyi.zhao@gmail.com</a>> <br>Xinjiang Technical Institute of Physics and Chemistry<br>
Chinese Academy of Sciences <br>GnuPG DSA: 0xD108493
</div></div></div></div></div></div></div></div></div>