<div dir="ltr">On Thu, Mar 27, 2014 at 11:09 PM, Hongyi Zhao <span dir="ltr"><<a href="mailto:hongyi.zhao@gmail.com" target="_blank">hongyi.zhao@gmail.com</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div>Hi all,<br><br></div>Currently, I use bind9 as the local dns cache server and a forwarder only server.<br>
<br></div>I set the dnscrpyt-proxy running on local port 50 as the upstream dns server for my bind9 dns cache server.<br>
<br></div><div>In addtition, I also want to have long TTL so that I can obtain a short inquiry respond time.<br><br></div>For all of the above purposes, I use the following configure file:<br clear="all"><div><div><div><div>
<div><div><div><div><br>-------------------<br>$ cat /etc/bind/named.conf.options<br>options {<br> directory "/var/cache/bind";<br><br> // If there is a firewall between you and nameservers you want<br> // to talk to, you may need to fix the firewall to allow multiple<br>
// ports to talk. See <a href="http://www.kb.cert.org/vuls/id/800113" target="_blank">http://www.kb.cert.org/vuls/id/800113</a><br><br> // If your ISP provided one or more IP addresses for stable <br> // nameservers, you probably want to use them as forwarders. <br>
// Uncomment the following block, and insert the addresses replacing <br> // the all-0's placeholder.<br><br> // forwarders {<br> // 0.0.0.0;<br> // };<br><br> forward only;<br> forwarders {127.0.0.1 port 50 ;} ;<br>
<br> cleaning-interval 1440;<br> max-cache-ttl 2419200;<br> max-ncache-ttl 86400;<br> max-cache-size unlimited;<br> stacksize unlimited;<br> datasize unlimited;<br> coresize unlimited;<br><br> //========================================================================<br>
// If BIND logs error messages about the root key being expired,<br> // you will need to update your keys. See <a href="https://www.isc.org/bind-keys" target="_blank">https://www.isc.org/bind-keys</a><br> //========================================================================<br>
// dnssec-validation auto;<br><br> auth-nxdomain no; # conform to RFC1035<br> listen-on-v6 { any; };<br>};<br>-----------------------<br><br></div><div>Then I restart my dns server with the followoing command to let the above config take in effect:<br>
<br></div><div>sudo service bind9 restart<br><br></div><div>But, I still have low TTL, because I've tried that the following command:<br><br></div><div>----------------<br>werner@debian:~$ dig <a href="http://ssh.sshcenter.info" target="_blank">ssh.sshcenter.info</a><br>
<br>; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> <a href="http://ssh.sshcenter.info" target="_blank">ssh.sshcenter.info</a><br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 676<br>
;; flags: qr rd ra; QUERY: 1, ANSWER: 15, AUTHORITY: 0, ADDITIONAL: 0<br><br>;; QUESTION SECTION:<br>;<a href="http://ssh.sshcenter.info" target="_blank">ssh.sshcenter.info</a>. IN A<br><br>;; ANSWER SECTION:<br>
<a href="http://ssh.sshcenter.info" target="_blank">ssh.sshcenter.info</a>. 60 IN CNAME <a href="http://c-ssh.cloudkvm.net" target="_blank">c-ssh.cloudkvm.net</a>.<br>
<a href="http://c-ssh.cloudkvm.net" target="_blank">c-ssh.cloudkvm.net</a>. 60 IN A 23.226.226.124<br><a href="http://c-ssh.cloudkvm.net" target="_blank">c-ssh.cloudkvm.net</a>. 60 IN A 69.197.147.93<br>
<a href="http://c-ssh.cloudkvm.net" target="_blank">c-ssh.cloudkvm.net</a>. 60 IN A 96.44.134.231<br>
<a href="http://c-ssh.cloudkvm.net" target="_blank">c-ssh.cloudkvm.net</a>. 60 IN A 107.150.4.170<br><a href="http://c-ssh.cloudkvm.net" target="_blank">c-ssh.cloudkvm.net</a>. 60 IN A 162.211.227.83<br>
<a href="http://c-ssh.cloudkvm.net" target="_blank">c-ssh.cloudkvm.net</a>. 60 IN A 173.254.237.179<br>
<a href="http://c-ssh.cloudkvm.net" target="_blank">c-ssh.cloudkvm.net</a>. 60 IN A 192.3.23.197<br><a href="http://c-ssh.cloudkvm.net" target="_blank">c-ssh.cloudkvm.net</a>. 60 IN A 192.161.175.143<br>
<a href="http://c-ssh.cloudkvm.net" target="_blank">c-ssh.cloudkvm.net</a>. 60 IN A 192.227.161.20<br>
<a href="http://c-ssh.cloudkvm.net" target="_blank">c-ssh.cloudkvm.net</a>. 60 IN A 199.119.224.224<br><a href="http://c-ssh.cloudkvm.net" target="_blank">c-ssh.cloudkvm.net</a>. 60 IN A 199.233.236.200<br>
<a href="http://c-ssh.cloudkvm.net" target="_blank">c-ssh.cloudkvm.net</a>. 60 IN A 23.90.4.124<br>
<a href="http://c-ssh.cloudkvm.net" target="_blank">c-ssh.cloudkvm.net</a>. 60 IN A 23.92.50.22<br><a href="http://c-ssh.cloudkvm.net" target="_blank">c-ssh.cloudkvm.net</a>. 60 IN A 23.94.104.29<br>
<br>;; Query time: 1208 msec<br>
;; SERVER: 127.0.0.1#53(127.0.0.1)<br>;; WHEN: Fri Mar 28 14:04:01 2014<br>;; MSG SIZE rcvd: 292<br>--------------------<br></div><div><br></div><div>Though in above query, the query time is 1208 msec, if I immediately do the second query, the query time will be dramtically shorttened. But after several minites, I will still obtain a long query time as the above one. The OS used by me is Debian GNU/Linux 7.4 (wheezy).<br>
<br></div><div>Any hints on this issue?<br><br></div><div>Regards<span class="HOEnZb"><font color="#888888"><br>-- <br>Hongyi Zhao <<a href="mailto:hongyi.zhao@gmail.com" target="_blank">hongyi.zhao@gmail.com</a>> <br>
Xinjiang Technical Institute of Physics and Chemistry<br>
Chinese Academy of Sciences <br>GnuPG DSA: 0xD108493
</font></span></div></div></div></div></div></div></div></div></div><br></blockquote><div><br></div><div>TTL is specified in the RR that you get back from the remote server.. That time is both the default and the maximum TTL for data placed into cache. Lengthening TTL beyond the value in the RR violates the specification and potentially badly breaks DNS. If an RR response says that the TTL is 1 minute, you can shorten it, but you cannot increase it. That is why all of the parameters are maximum times.<br>
<br></div><div>Of course, this will result in your server re-querying an authoritative server after the TTL has expired and this will take longer, but holding data longer than the TTL can (an often does) result the wrong data. For example, if a server is about to move to a new address, it is normal to decrease the TTL to a very small value so that the old address will not be used after the server is moved. Not honoring this TTL will result in attempts to access the wrong address which probably will result in a failure, but may result in getting old data. from a system that is no longer updating.<br>
<br></div><div>Also beware of using too great an ncache TTL. This is the time to wait to retry querying after an authoritative failure (NDOMAIN). It is to prevent flooding a server with queries that will always fail until something changes. Should a link be created before the server it points to is up, the time to wait before bothering to ask again is the ncache time. One day is very, very long. Times like 1 minute are more appropriate, but again, this is a maximum, so the large value may not be an issue.<br>
</div><div><br></div><div>Sorry.<br></div></div>-- <br><div dir="ltr">R. Kevin Oberman, Network Engineer, Retired<br>E-mail: <a href="mailto:rkoberman@gmail.com" target="_blank">rkoberman@gmail.com</a><br></div>
</div></div>