5

I pay for a DNS service based on queries per second.

We are not using IPv6, but a large number of queries (that I pay for) are coming in for AAAA records. I understand that most DNS stacks will now ask for A and AAAAs at the same time, and that I can't change that.

What I would like to do is put something in the AAAA records with a long TTL. (decreasing my hit rate)

Is there anything I can put? Null? The equivalent IPv4 Address?

Any guidance would be appreciated.

Improve this question

2 Answers 2

Reset to default
5

In BIND 9 the "minimum" value in the SOA record expresses how long an NXDOMAIN response may be cached. This is the last value in the following example:

example.com.    IN    SOA   ns.example.com. hostmaster.example.com. (
                              2003080800 ; sn = serial number
                              172800     ; ref = refresh = 2d
                              900        ; ret = update retry = 15m
                              1209600    ; ex = expiry = 2w
                              3600       ; min = minimum = 1h
                              )

Change it to something a bit longer, say 86400 (1 day) or even 604800 (1 week).

Keep in mind that this applies to negative caching of any nonexistent record, not just AAAA records, so you'll need to take additional steps when adding new records of any type (reduce this value, wait, add the new record, increase this value again).

Improve this answer
2
  • I'm also using a * record for A, and that's what will catch all unknown IPv4 requests. So I can set that lower than my minimum negative cache... Seems to be working.
    – Joel K
    Oct 31, 2012 at 4:29
  • Keep in mind that in some DNS platforms, setting min TTL in SOA can and will change the TTL for records using "default" TTL, and not just unknown records.
    – eitanpo
    Dec 5, 2012 at 10:54
4

There's no such thing as null AAAA record. Nor there's an IPv6 equivalent for IPv4 address (RFC 4291 mentions such mechanism but it's deprecated). This means that IPv6 aware systems will attempt to connect to IPv6 address you put there. While I think most browsers will fall-back to IPv4 if they get no response on IPv6, yet your empty IPv6 will result in slower responses for many users. Besides, I feel that it's just "wrong" thing to do.

The "right" thing to do is support IPv6 of course (sometimes it can be effortless, depends on your particular case of course).

If supporting IPv6 connectivity is not practical now, you may also increase TTL time for negative response caching - it is the last field of your domain SOA record.

EDIT: You may also need to increase TTL of the SOA record iself - negative caching time is a minimum of the two values - 1. SOA "minimum" field and 2. TTL of the SOA record itself. (Source: RFC2308, section 3)

Improve this answer
3
  • Sadly -- AWS doesn't support IPv6
    – Joel K
    Oct 30, 2012 at 20:11
  • @JoelK If it's for web - they do support IPv6 partially via "elastic load-balancers"
    – Sandman4
    Oct 31, 2012 at 9:44
  • I would add that not only will an invalid AAAA record make the site slower for many users, it will also completely break the site for users accessing the site through NAT64.
    – kasperd
    Jan 10, 2017 at 20:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .