0

I've found a similar post about this, however my user can't comment.

I wonder why doing dig @8.8.8.8 domain.com prints out different "countdowns" when running it several times in few seconds, as if that domain was cached in different places inside 8.8.8.8 with different TTLs.

For example,

dione@saturno:~$ dig serverfault.com @8.8.8.8 +noall +answer

; <<>> DiG 9.9.5-3ubuntu0.1-Ubuntu <<>> serverfault.com @8.8.8.8 +noall +answer
;; global options: +cmd
serverfault.com.    39  IN  A   198.252.206.140
dione@saturno:~$ dig serverfault.com @8.8.8.8 +noall +answer

; <<>> DiG 9.9.5-3ubuntu0.1-Ubuntu <<>> serverfault.com @8.8.8.8 +noall +answer
;; global options: +cmd
serverfault.com.    288 IN  A   198.252.206.140
dione@saturno:~$ dig serverfault.com @8.8.8.8 +noall +answer

; <<>> DiG 9.9.5-3ubuntu0.1-Ubuntu <<>> serverfault.com @8.8.8.8 +noall +answer
;; global options: +cmd
serverfault.com.    37  IN  A   198.252.206.140
dione@saturno:~$ dig serverfault.com @8.8.8.8 +noall +answer

; <<>> DiG 9.9.5-3ubuntu0.1-Ubuntu <<>> serverfault.com @8.8.8.8 +noall +answer
;; global options: +cmd
serverfault.com.    36  IN  A   198.252.206.140
dione@saturno:~$ dig serverfault.com @8.8.8.8 +noall +answer

; <<>> DiG 9.9.5-3ubuntu0.1-Ubuntu <<>> serverfault.com @8.8.8.8 +noall +answer
;; global options: +cmd
serverfault.com.    284 IN  A   198.252.206.140
2
  • Anycast ftw. google.com/… – dmourati Jan 27 '15 at 6:23
  • However, when I query after some time using 8.8.8.8 servers, TTL shows 14400 and starts decreasing again. I thought it was about to show the actual TTL left! – whitenoisedb Jan 27 '15 at 17:54
4

The reason why different TTLs are shown at different query is that 8.8.8.8 is a (Virual IP) load balancer which has many DNS servers attached to it. And so every new request that arrive lands on different DNS server each time.

This is true with all public DNS servers. And if you would like to know the actual TTL of a domain then you have to query the (SOA) authoritative DNS server of that domain. And so ns1.google.com. is the authoritative for google.com domain and querying it will give you a fixed (actual) TTL every time.

$ dig google.com @ns1.google.com.

; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> google.com @ns1.google.com.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5513
;; flags: qr aa rd; QUERY: 1, ANSWER: 11, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;google.com.            IN  A

;; ANSWER SECTION:
google.com.     300 IN  A   74.125.236.78
google.com.     300 IN  A   74.125.236.67
google.com.     300 IN  A   74.125.236.68
google.com.     300 IN  A   74.125.236.73
google.com.     300 IN  A   74.125.236.69
google.com.     300 IN  A   74.125.236.64
google.com.     300 IN  A   74.125.236.71
google.com.     300 IN  A   74.125.236.70
google.com.     300 IN  A   74.125.236.66
google.com.     300 IN  A   74.125.236.65
google.com.     300 IN  A   74.125.236.72

;; Query time: 101 msec
;; SERVER: 216.239.32.10#53(216.239.32.10)
;; WHEN: Tue Jan 27 12:06:58 2015
;; MSG SIZE  rcvd: 204
10
  • When querying authoritative servers with dig, it is a good idea to specify +norecurse. – kasperd Jan 27 '15 at 7:09
  • So, at some time it'll be updated on only 1 google DNS server while others keep outdated? – whitenoisedb Jan 27 '15 at 7:20
  • @redraw ns1.google.com. is not a single DNS server again, It is a group of DNS servers which are behind a load balancer with name ns1.google.com. The TTL in this doesnt change because they dont expire and this TTL information is for DNS servers which are non-authoritative like 8.8.8.8 and others. – Kannan Mohan Jan 27 '15 at 7:26
  • @redraw When querying 8.8.8.8 after the authoritative data has changed you may get different answers depending on which server you hit until the full TTL has passed – Håkan Lindqvist Jan 27 '15 at 7:52
  • I mean, I'm querying 8.8.8.8, and say authoritative data has changed because I've edited some dns zone in my server. At the end, I'll see that for example, one TTL could have finished, but it is still alive in others (inside 8.8.8.8 network) – whitenoisedb Jan 27 '15 at 15:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.