4 ms·

If this is affecting you it's best to put a long TTL (at least 1 hour) on your domains. That way a good lookup will be cached longer and it will affect less peo

by JelteF 9y ago

If this is affecting you it's best to put a long TTL (at least 1 hour) on your domains. That way a good lookup will be cached longer and it will affect less people.

cjsuk 9y ago
Won't this also cache a bad record for longer like NXDOMAIN which is what we're getting?
- JelteF 9y ago
  No, the TTL for caching NXDOMAIN is decided by the nameservers SOA record. In this case 900 (15 minutes). The reason for this is that if there's no domain there's also no way to get it's TTL.
  - cjsuk 9y ago
    Thanks for the clarification - much appreciated!
- benmmurphy 9y ago
  i think negative results are cached using a different value. [https://serverfault.com/questions/426807/how-long-does-negative-dns-caching-typically-last https://serverfault.com/questions/426807/how-long-does-negat...] but last time io had a problem we continued to have downtime after it was resolved because of a high value for the SOA record :(
  - cjsuk 9y ago
    Thanks for the reply. Much appreciated.
nodesocket 9y ago
All of my .io DNS records have a TTL of 24 hours and 3600 (refresh-time) 900 (retry-time) 1814400 (expire-time) 60 (negative caching TTL). My PagerDuty is going bat nuts.
sandstrom 9y ago
If the domain/zone records are handled by someone other than nic-io (say Route53), does that really help? If I change the TTL for an A-record in Route53, how will that help if there is an NS-issue with nic-io? (awesome if you could explain!) Also, does the SOA and NS records have any effect here?
- aeden 9y ago
  If their servers were unresponsive, then a long TTL might help as caching resolvers would retry and eventually get a successful result. Based on the output of the OPs tests, they are responding with incorrect NXDOMAIN results. This means that resolvers will cache the NXDOMAIN result using the SOA negative result TTL. You could remove the delegation entries for the name servers that are returning results though, that might help.
  - X-Istence 9y ago
    nic-io would need to remove the delegation entries, since it is the .io servers that are returning the wrong response. This has nothing to do with any DNS servers actually hosting the <domain>.io zones.
- JelteF 9y ago
  There's a random chance that a DNS request resolves correctly because not all nic-io domain servers are returning incorrect results. If you provide a high TTL on your own records they will be cached for a longer time. Which has as a result that there will be less requests going to the nic-io servers. This still doesn't rule out bad responses. As far as I know there's no way to achieve that. However, it will make sure correct ones stay active longer. A high TTL on your NS records would be good as well for the same reason. On the SOA it shouldn't really matter.

by JelteF 9y ago

If this is affecting you it's best to put a long TTL (at least 1 hour) on your domains. That way a good lookup will be cached longer and it will affect less people.

cjsuk 9y ago

Won't this also cache a bad record for longer like NXDOMAIN which is what we're getting?

JelteF 9y ago
No, the TTL for caching NXDOMAIN is decided by the nameservers SOA record. In this case 900 (15 minutes). The reason for this is that if there's no domain there's also no way to get it's TTL.
- cjsuk 9y ago
  Thanks for the clarification - much appreciated!
benmmurphy 9y ago
i think negative results are cached using a different value. [https://serverfault.com/questions/426807/how-long-does-negative-dns-caching-typically-last https://serverfault.com/questions/426807/how-long-does-negat...] but last time io had a problem we continued to have downtime after it was resolved because of a high value for the SOA record :(
- cjsuk 9y ago
  Thanks for the reply. Much appreciated.

nodesocket 9y ago

All of my .io DNS records have a TTL of 24 hours and 3600 (refresh-time) 900 (retry-time) 1814400 (expire-time) 60 (negative caching TTL). My PagerDuty is going bat nuts.

sandstrom 9y ago

If the domain/zone records are handled by someone other than nic-io (say Route53), does that really help? If I change the TTL for an A-record in Route53, how will that help if there is an NS-issue with nic-io? (awesome if you could explain!) Also, does the SOA and NS records have any effect here?

aeden 9y ago
If their servers were unresponsive, then a long TTL might help as caching resolvers would retry and eventually get a successful result. Based on the output of the OPs tests, they are responding with incorrect NXDOMAIN results. This means that resolvers will cache the NXDOMAIN result using the SOA negative result TTL. You could remove the delegation entries for the name servers that are returning results though, that might help.
- X-Istence 9y ago
  nic-io would need to remove the delegation entries, since it is the .io servers that are returning the wrong response. This has nothing to do with any DNS servers actually hosting the <domain>.io zones.
JelteF 9y ago
There's a random chance that a DNS request resolves correctly because not all nic-io domain servers are returning incorrect results. If you provide a high TTL on your own records they will be cached for a longer time. Which has as a result that there will be less requests going to the nic-io servers. This still doesn't rule out bad responses. As far as I know there's no way to achieve that. However, it will make sure correct ones stay active longer. A high TTL on your NS records would be good as well for the same reason. On the SOA it shouldn't really matter.