<div data-ntes="ntes_mail_body_root" style="line-height:1.7;color:#000000;font-size:14px;font-family:Arial"><div style="margin:0;"><div data-lark-html-role="root"><span class="universal-card-text">Hi,</span><br><br><span class="universal-card-text">I'm reporting a potential issue observed in BIND 9.20.24 with the </span><span class="universal-card-code-span"><span class="universal-card-text">stale-answer-client-timeout</span></span><span class="universal-card-text"> option.</span><br><br><span class="universal-card-text universal-card-text--bold">Environment:</span><br><div class="universal-card-markdown-list"><ul class="universal-card-markdown-list__ul"><li data-marker="0"><div class="universal-card-markdown-list__li-content"><span class="universal-card-text">BIND version: 9.20.24</span></div></li></ul><ul class="universal-card-markdown-list__ul"><li data-marker="0"><div class="universal-card-markdown-list__li-content"><span class="universal-card-text">Role: Caching/forwarding resolver (localdns)</span></div></li></ul><ul class="universal-card-markdown-list__ul"><li data-marker="0"><div class="universal-card-markdown-list__li-content"><span class="universal-card-text">The localdns forwards queries for the </span><span class="universal-card-code-span"><span class="universal-card-text">sys.srvtest</span></span><span class="universal-card-text"> zone to an internal authoritative DNS server.</span></div></li></ul><ul class="universal-card-markdown-list__ul"><li data-marker="0"><div class="universal-card-markdown-list__li-content"><span class="universal-card-text">TTL for </span><span class="universal-card-code-span"><span class="universal-card-text">transfer.sys.srvtest</span></span><span class="universal-card-text">: </span><span class="universal-card-text universal-card-text--bold">120 seconds</span><span class="universal-card-text"> (A record only)</span></div></li></ul></div><span class="universal-card-text universal-card-text--bold">Configuration (related):</span><br><br><div class="universal-card-markdown-code-block__wrapper"><div class="universal-card-markdown-code-block universal-card-markdown-code-block--max-num-1"><div class="universal-card-markdown-code-block__code-line" data-line-num="1">stale-answer-enable yes;</div><div class="universal-card-markdown-code-block__code-line" data-line-num="2">stale-cache-enable yes;</div><div class="universal-card-markdown-code-block__code-line" data-line-num="3">stale-answer-client-timeout 0;</div><div class="universal-card-markdown-code-block__code-line" data-line-num="4"></div><div class="universal-card-markdown-code-block__code-line" data-line-num="5">zone "sys.srvtest" {</div><div class="universal-card-markdown-code-block__code-line" data-line-num="6">    type forward;</div><div class="universal-card-markdown-code-block__code-line" data-line-num="7">    forwarders { <internal_auth_ip>; };</div><div class="universal-card-markdown-code-block__code-line" data-line-num="8">};</div></div></div><br><span class="universal-card-text universal-card-text--bold">Observation:</span><br><div class="universal-card-markdown-list"><ul class="universal-card-markdown-list__ul"><li data-marker="0"><div class="universal-card-markdown-list__li-content"><span class="universal-card-text">Client queries received by localdns for </span><span class="universal-card-code-span"><span class="universal-card-text">transfer.sys.srvtest</span></span><span class="universal-card-text">: </span><span class="universal-card-text universal-card-text--bold">~2,700</span></div></li></ul><ul class="universal-card-markdown-list__ul"><li data-marker="0"><div class="universal-card-markdown-list__li-content"><span class="universal-card-text">Queries from localdns to the authoritative server for </span><span class="universal-card-code-span"><span class="universal-card-text">transfer.sys.srvtest</span></span><span class="universal-card-text">: </span><span class="universal-card-text universal-card-text--bold">~1,200</span></div></li></ul></div><span class="universal-card-text">With a TTL of 120s, the expected authoritative query volume would be roughly </span><span class="universal-card-code-span"><span class="universal-card-text">total_queries / 120 ¡Ö 22</span></span><span class="universal-card-text">. The observed 1,200 is approximately </span><span class="universal-card-text universal-card-text--bold">55x</span><span class="universal-card-text"> higher than expected.</span><br><br><span class="universal-card-text universal-card-text--bold">After removing </span><span class="universal-card-code-span"><span class="universal-card-text universal-card-text--bold">stale-answer-client-timeout 0</span></span><span class="universal-card-text universal-card-text--bold">:</span><br><div class="universal-card-markdown-list"><ul class="universal-card-markdown-list__ul"><li data-marker="0"><div class="universal-card-markdown-list__li-content"><span class="universal-card-text">Client queries to localdns: </span><span class="universal-card-text universal-card-text--bold">~2,700</span><span class="universal-card-text"> (similar traffic)</span></div></li></ul><ul class="universal-card-markdown-list__ul"><li data-marker="0"><div class="universal-card-markdown-list__li-content"><span class="universal-card-text">Queries from localdns to the authoritative server: </span><span class="universal-card-text universal-card-text--bold">~10</span><span class="universal-card-text"> (close to expected)</span></div></li></ul></div><span class="universal-card-text universal-card-text--bold">Hypothesis:</span><br><br><span class="universal-card-text">The queried name </span><span class="universal-card-code-span"><span class="universal-card-text">transfer.sys.srvtest</span></span><span class="universal-card-text"> only has an A record configured on the authoritative server. Since clients (e.g. curl) typically send both A and AAAA queries simultaneously, each client request generates two lookups:</span><br><div class="universal-card-markdown-list"><ul class="universal-card-markdown-list__ul"><li data-marker="0"><div class="universal-card-markdown-list__li-content"><span class="universal-card-text">A query: cache hit, served from cache</span></div></li></ul><ul class="universal-card-markdown-list__ul"><li data-marker="0"><div class="universal-card-markdown-list__li-content"><span class="universal-card-text">AAAA query: no record exists, potentially triggering repeated authoritative lookups</span></div></li></ul></div><span class="universal-card-text">With </span><span class="universal-card-code-span"><span class="universal-card-text">stale-answer-client-timeout 0</span></span><span class="universal-card-text">, BIND may attempt to refresh stale AAAA negative cache entries on every query, amplifying the authoritative query volume. Without this setting, BIND relies on normal negative caching (</span><span class="universal-card-code-span"><span class="universal-card-text">max-ncache-ttl</span></span><span class="universal-card-text">), reducing unnecessary authoritative queries.</span><br><br><span class="universal-card-text universal-card-text--bold">Question:</span><br><span class="universal-card-text">Is this expected behavior? I would expect </span><span class="universal-card-code-span"><span class="universal-card-text">stale-answer-client-timeout 0</span></span><span class="universal-card-text"> to only affect the stale response timing (return stale immediately vs. wait for authoritative), not to cause additional authoritative lookups for records with valid TTLs. Could there be a bug where the stale refresh logic is also triggered for negative cache entries (NODATA/NXDOMAIN)?</span><br><br><span class="universal-card-text">Please let me know if this is a known behavior or if additional debugging information (query logs, packet captures) would be helpful.</span></div></div></div>