To start with, I don't know jack about DNS servers. I have been stuck with resolving a problem with a DNS-Server because I discovered a problem with one of our systems and determined that it was caused by the DNS resolution.

We use an external web service for some critical operations. Our software is in constant communication with the external service. The external provider actually has two hosts (each with its own IP Address) that provide this service, and changes the DNS records so that the one name (call it criticalservice.example.com) always resolves to the currently active host.

Our software periodically checks the connection to the external system. As long as the name resolves to the correct active host, all is good. However, the provider occasionally changes the active host (and the DNS record to match.) Our system keeps the old IP address for the host name cached until the TTL expires. Until it expires and gets the correct IP address, our system reports a communication error and can't be used. Once the IP address catches up, our system automatically reconnects and goes back to work. The time it spends offline can be anything up to the full TTL period - our DNS server seems to use 3600 seconds as the default TTL.

The service is not critical as in life and death, but critical in the sense of not being able to notify people who might be needed to deal with a life and death situation as quickly as possible. Given that, we would really like to shorten the time the system spends waiting for the DNS TTL.

The DNS-Server from the ISP has a very short TTL for criticalservice.example.com, and the ISP recommends either using their DNS directly or using a very short TTL on our internal DNS Server.

Since our DNS server is also an Active Directory domain server, I don't think that changing the TTL for the entire DNS server is a good idea.

The best idea I have would be to set a TTL only for criticalservice.example.com.

How would I create a DNS entry for criticalservice.example.com in our Windows 2008 Server that would limit the cache time to less than 1 minute, but still allow our DNS server to pick up the correct IP address from the ISP DNS Server? As far as I can tell, I can only set a TTL if I add a record that maps the name to the IP address - and I can't do that because the IP address changes.

Alternatively, could I do something to the DNS client on our machine that uses criticalservice.example.com so that it bypasses our DNS Server, but only for criticalservice.example.com?

Additional info: nslookup -qa=A criticalservice.example.com local.dns.server returns TTL of 3600 seconds. nslookup -qa=A criticalservice.example.com isp.dns.com returns TTL of 15 seconds.

  • I think that you may not be interpreting the TTL correctly. The TTL that comes back from nslookup is the remaining TTL for that record in whatever DNS server you're querying. So each DNS server you're querying is going to show a different TTL value dependent upon when it cached that record. If you want to see the default TTL of the record you're querying then run nslookup against the authoritative DNS server for that record.
    – joeqwerty
    Nov 14, 2014 at 15:55
  • @joeqwerty - That may well be true as I'm not real familiar with such things. The fact still remains, though, that our system loses connection because the DNS resolution returns the old IP address for a long while after a change.
    – JRE
    Nov 14, 2014 at 16:08

1 Answer 1


I would just let your DNS server do what DNS was designed to do. Don't try to configure the domain in your DNS server. Your DNS server will cache the DNS entries for the TTL specified by the provider. At worst, you will have a stale entry for the TTL specified by the provider.

If you do set up the entry in your DNS, set the TTL to a value no larger than the provider specified. You will still need an system to check the provider's DNS and update your DNS. This will add more complexity to your setup, and increase the risk of failure. You will also generate at least as much DNS traffic as specified above.

It is possible to define TTL on a per entry basis, although I don't have experience doing so in active directory. Your provider is likely doing so on their server.

  • I've added more information to the question. The TTL doesn't seem to carry over from the ISP to our DNS server.
    – JRE
    Nov 14, 2014 at 14:19
  • @JRE The TTL on your server will start at the authoritative (ISPs?) server's value and count down to zero. Don't expect them to be the same. Once your DNS server's TTL reaches 0 it will recheck with the authoritative server for the current (possibly changed) information.
    – BillThor
    Nov 14, 2014 at 23:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.