1

I'm confused about the responses I'm getting doing a DNS query using authoritative vs non-authoritative and I'd appreciate you can help clarify.

When I query www.google.com using the authoritative server:

nslookup -debug www.google.com ns1.google.com

ANSWERS:
    ->  www.google.com
        internet address = 172.217.195.147
        ttl = 300 (5 mins)

When I query www.google.com using a non-authoritative server:

nslookup -debug www.google.com 8.8.8.8

ANSWERS:
    ->  www.google.com
        internet address = 216.58.192.132
        ttl = 235 (3 mins 55 secs)

As you can see the TTL of the authoritative server is the raw value of 300 but the TTL of the non-authoritative is the value showing how much time is left before it expires (it is counting down).

  1. For the non-authoritative case, is the TTL really coming from the non-authoritative server or is that somehow showing the cache on my system?

  2. If someone is using a non-authoritative server for as their DNS resolver, then does that mean they must honor what is returned so in the case where 1 is returned for TTL they must refresh again after 1 second ?

1 Answer 1

4
  1. If the queried value is not in the cache of the non-authoritative server, it will fetch the value from the authoritative server. This server will specify a TTL, in this case 300. The non-authoritative server will then return this answer with a TTL of 300. If 100 seconds later, the same value is queried again, the non-authoritative server will find it in the cache, but because 100 seconds have elapsed, it will return the answer with a TTL of 200 (300-100).

  2. Yes, if the remaining TTL was 1, then the entry expires after 1 second and must be refreshed. As the value also expired in the cache of the non-authoritative server, the non-authoritative server will again query the authoritative server, and will return the answer with a TTL of 300.

    A TTL of 1 when the original TTL was 300 means the authoritative server was queried 299 seconds ago (300-1) and that there is just one second of the originally granted TTL left.

Basically, every answer the authoritative server gave at any time will expire after 300 seconds, wherever it may be cached, in a non-authoritative server, in a resolver that queried the non-authoritative server, and so on.

1
  • This is correct but an additional important point must be remembered: TTLs are a maximum time advised to cache the value. Resolvers are free to drop the entry before, for policy or operational reasons (cache full). Also resolvers are kind of advised to "rejuvenate" hot entries in advance of their expiration, to not make clients wait for the resolver to ask the authoritative again. One has to remember also that, again for local policy reasons typically, some resolvers just shape TTLs in ways they want, specifically many do not honour TTLs below 300 or things like that. Nov 9, 2021 at 15:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .