Here's my scenario:
- I have an office which connects to AWS via a VPN tunnel to access some EC2 instances.
- The office computers use AWS Route 53 via the VPN tunnel to resolve a private hosted zone.
- The private hosted zone contains A records of assets located in the office. Printers, application servers, etc.
- Office workstations are configured to use the internal address of AWS' DNS server (in the subnet with EC2 instances).
Everything is resolving fine.
Now in order to cater for the VPN tunnel going down and therefore reachability to AWS' DNS server going down too, I configured the DNS records of the internal assets to have a TTL of 432,000 seconds, or 5 days. Basically that gives me 5 days to reestablish the VPN tunnel before office workstations fail to resolve, by name, the internal assets.
However, I've noticed the following behaviour and am wondering whether this is "normal" for the resolver and (Windows 10) client?
- Querying the authoritative server shows the TTL to be 432,000
- Querying the resolver shows TTL to be 86,400
- Querying the client (e.g.
ipconfig /displaydns) also shows 86,400 (and decrements which is normal behaviour).
I've tried changing the TTL and it appears that the Windows client will respect any TTL value less than or equal to 86,400.
Why does the record's TTL of 432,000 at the authoritative server level not get propagated to the resolver and therefore the client? Am I misunderstanding something fundamental to how TTLs work?
Thanks in advanced!