3 ms·
> those NS records have a 6 hour TTL Why on earth would any system need a TTL beyond 1 hour? The longer the TTL the longer your outage period will be if a cach
by DaiPlusPlus 5y ago
> those NS records have a 6 hour TTL
Why on earth would any system need a TTL beyond 1 hour? The longer the TTL the longer your outage period will be if a cache is poisoned.
- Thorrez 5y agoCould something with a normal 1 hour TTL be poisoned by a cache entry with a 30 day TTL?
- fomine3 5y agoShorter TTL increases poisoning risk. Anyway attacker can set arbitrary TTL if they succeed poisoning so longer TTL won't increase risk.
- jbotz 5y agoHeh. I remember the day when a TTL of a week was pretty standard. Anyway, the since the NS records for a domain come from the next level up, i.e. in this case the .com nameserver which are also the root nameservers, if they had a short TTL then those root nameservers would get hit pretty hard. Also, it isn't your choice what the TTL on your NS records is, it's admins of your top-level domains.
- mcspiff 5y agoOn the flip side, it’s the longer you can survive an outage by relying on enough clients having the cached records. So can go both ways a bit.
- throwaway09223 5y ago"Why on earth would any system need a TTL beyond 1 hour?" Load. Lower TTLs mean shorter term caches and more traffic. This is a big deal, especially for root servers -- which is why the TTL is not customizable.
- toast0 5y ago.com (used for Facebook authoritative DNS) and .net (used for WhatsApp) servers serve glue records with a 2 day TTL, and domain holders don't get to choose TTL. (the root servers serve glue records for the TLDs with a 2 day TTL as well). So, two days is the TTL you get for your NS records. Of course, it takes way more than two days for people to stop querying your old records. I gave up after 30-45 days.