Hacker News Reader

Comment by JelteF | Hacker News Reader

If this is affecting you it's best to put a long TTL (at least 1 hour) on your domains. That way a good lookup will be cached longer and it will affect less people.

View on HN

Won't this also cache a bad record for longer like NXDOMAIN which is what we're getting?

No, the TTL for caching NXDOMAIN is decided by the nameservers SOA record. In this case 900 (15 minutes). The reason for this is that if there's no domain there's also no way to get it's TTL.

Thanks for the clarification - much appreciated!

i think negative results are cached using a different value. [https://serverfault.com/questions/426807/how-long-does-negat...]

but last time io had a problem we continued to have downtime after it was resolved because of a high value for the SOA record :(

Thanks for the reply. Much appreciated.

If the domain/zone records are handled by someone other than nic-io (say Route53), does that really help?

If I change the TTL for an A-record in Route53, how will that help if there is an NS-issue with nic-io?

(awesome if you could explain!)

Also, does the SOA and NS records have any effect here?

If their servers were unresponsive, then a long TTL might help as caching resolvers would retry and eventually get a successful result. Based on the output of the OPs tests, they are responding with incorrect NXDOMAIN results. This means that resolvers will cache the NXDOMAIN result using the SOA negative result TTL.

You could remove the delegation entries for the name servers that are returning results though, that might help.

nic-io would need to remove the delegation entries, since it is the .io servers that are returning the wrong response. This has nothing to do with any DNS servers actually hosting the <domain>.io zones.

There's a random chance that a DNS request resolves correctly because not all nic-io domain servers are returning incorrect results. If you provide a high TTL on your own records they will be cached for a longer time. Which has as a result that there will be less requests going to the nic-io servers.

This still doesn't rule out bad responses. As far as I know there's no way to achieve that. However, it will make sure correct ones stay active longer.

A high TTL on your NS records would be good as well for the same reason. On the SOA it shouldn't really matter.

All of my .io DNS records have a TTL of 24 hours and 3600 (refresh-time) 900 (retry-time) 1814400 (expire-time) 60 (negative caching TTL). My PagerDuty is going bat nuts.

Reply on news.ycombinator.com