2

The registrar points to our nameservers, and our nameservers point to themselves. If you query either the registrar or our own nameservers, you get the same responses. But they have different TTLs. Which TTL will clients honour?

$ dig dotser.ie ns @b.iedr.ie

; <<>> DiG 9.8.1-P1 <<>> dotser.ie ns @b.iedr.ie
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1393
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 3, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;dotser.ie.         IN  NS

;; AUTHORITY SECTION:
dotser.ie.      172800  IN  NS  ns0.reg365.net.
dotser.ie.      172800  IN  NS  ns2.reg365.net.
dotser.ie.      172800  IN  NS  ns1.reg365.net.

;; Query time: 27 msec
;; SERVER: 77.72.72.34#53(77.72.72.34)
;; WHEN: Thu Sep 11 13:46:12 2014
;; MSG SIZE  rcvd: 91

$ dig dotser.ie ns @ns0.reg365.net

; <<>> DiG 9.8.1-P1 <<>> dotser.ie ns @ns0.reg365.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64285
;; flags: qr aa rd; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;dotser.ie.         IN  NS

;; ANSWER SECTION:
dotser.ie.      86400   IN  NS  ns2.reg365.net.
dotser.ie.      86400   IN  NS  ns1.reg365.net.
dotser.ie.      86400   IN  NS  ns0.reg365.net.

;; Query time: 41 msec
;; SERVER: 85.233.160.79#53(85.233.160.79)
;; WHEN: Thu Sep 11 13:46:28 2014
;; MSG SIZE  rcvd: 91

A very similar question has already been asked, but its accepted (and only) answer suggests a workaround to the specific problem rather than actually answering the theoretical question.

Another similar question is not actually quite the same: it asks whether the nameservers will be cached for longer than the A records. (Anyway, none of the answers there seems to answer my question.)

Improve this question
1
  • A client won't ask both. It will end up using the TTL it gets from the one it does ask.
    – Brian
    Sep 11, 2014 at 13:25

3 Answers 3

Reset to default
2

A client will not ask your nameservers for the NS records; it already knows those at that point (otherwise it couldn't ask your nameservers...).

Hence clients will look to the TTL from the registrar.

Improve this answer
1
  • If any of the name servers are within the zone the registrar NS will provide those as "glue" (in the additional section, with TTLs). For those name servers outside the zone, the registrar may provide some/all of them the same way, or if needed the resolver will fetch them from the relevant authoritative servers. The TTLs the registrar NS returns are determined by the registrar and may be different to the real TTLs on NS or A records elsewhere (IEDR like many TLDs are known to clamp to minimum values, thus overriding short TTLs).
    – mr.spuratic
    Apr 4, 2019 at 17:00
1

The short answer is the last authoritative one. This should be from your servers.

If the DNS server does not have a value for the name server, it will have to traverse tree. The registrar should send a non-authoritative list of name servers.

The TTL provided for your name servers from the registrar will be overridden by your name servers. The authority section for requests from your name servers will include the list of your name servers and the TTL value that server holds. It is possible that different name servers may have different zone information and different TTL values, but they should converge relatively quickly.

A caching DNS server should update its TTL based on this. Non-authoritative responses from a cached DNS response should show the remaining TTL until the record expires.

Improve this answer
3
  • I didn't know that the registrar picked up the TTL from your own nameservers.
    – TRiG
    Sep 11, 2014 at 14:15
  • @TRiG I retested and found that the registrar's TTL gets overridden. I've rewritten my response.
    – BillThor
    Sep 12, 2014 at 1:52
  • RFC 2181 §5.4.1 makes it clear: "An authoritative answer from a reply should replace cached data that had been obtained from additional information in an earlier reply" and "[...] data from the authority section of a non-authoritative answer, should not be cached in such a way that they would ever be returned as answers to a received query".
    – mr.spuratic
    Jun 17, 2021 at 10:48
0

At the root level, the DNS servers for .ie have NS records for dotser.ie pointing to:

dotser.ie.              21210   IN      NS      ns2.reg365.net.
dotser.ie.              21210   IN      NS      ns1.reg365.net.
dotser.ie.              21210   IN      NS      ns0.reg365.net.

So only those three servers will ever be queries by clients (unless the clients use some non-default DNS resolution). Those three servers all have the same TTL of 21599 according to my lookups.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .