15

I looked up the man page and couldn't find how long dnsmasq cache a dns. what's the rule for caching and expiration?

I am having a problem that request send to an external service sometimes takes over 5 or 10 seconds for namelookup. I could save the external service ip to /etc/hosts but I am afraid of ip change. Installing Dnsmasq improves name lookup but slow namelookup still happens with less frequency.

One solution is to setup a simple ping in cron job but I need to find out the expiration time first.

thanks.

UPDATE

added dig output

; <<>> DiG 9.8.1-P1 <<>> api.mch.weixin.qq.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45012
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;api.mch.weixin.qq.com.             IN      A

;; ANSWER SECTION:
api.mch.weixin.qq.com.      0       IN      A       140.207.69.102

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Fri Jul 17 19:24:36 2015
;; MSG SIZE  rcvd: 55

UPDATE 2

the previous dig output contains TTL as 0 which is misleading. I have posted another dig output.

; <<>> DiG 9.8.1-P1 <<>> api.mch.weixin.qq.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60900
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;api.mch.weixin.qq.com.             IN      A

;; ANSWER SECTION:
api.mch.weixin.qq.com.      181     IN      CNAME   forward.qq.com.
forward.qq.com.             181     IN      A       101.226.90.149
forward.qq.com.             181     IN      A       101.226.129.200

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Jul 21 12:01:54 2015
;; MSG SIZE  rcvd: 99

3 Answers 3

12

DNSmasq uses the DNS TTL value for determining the caching period. You can use the dig command to query the current TTL of your DNS server for that domain.

11
  • Do you mean that dnsmasq only cache dns within the TTL period? I updated my question with the dig output.
    – perlwle
    Jul 17, 2015 at 11:21
  • 1
    Yes, only the TTL period is used for caching. And your TTL is 0, so DNSmasq will always make the query to the authorative DNS server. Jul 17, 2015 at 11:28
  • However, as stated in the manual, you can use --max-cache-ttl to force lower TTL for cached values (haven't tested it myself). Jul 17, 2015 at 13:21
  • @TeroKilkanen Query time: 0msec means a cache hit to dnsmasq. but how long dnsmasq will keep the dns record in cache?
    – perlwle
    Jul 17, 2015 at 16:26
  • @sam_pan_mariusz I think you meant the --max_ttl flag? I would rather to always get the right IP than miss the external service IP change.
    – perlwle
    Jul 17, 2015 at 16:29
5

The option you will need to set for dnsmasq is --min-cache-ttl, the value is in seconds.

According to the dig output, the TTL is 0, if you set this to, say --min-cache-ttl=600, then the TTL value which will be returned by dig will be 600. The TTL for api.mch.weixin.qq.com from where I am is 600, so setting it to 600 seconds yourself should be reasonably safe in avoiding missing any IP changes. (I'm guessing you are located in China.)

This will cause all DNS records to be considered valid for 10 minutes.

See the dnsmasq mailing list message detailing the introduction of this feature.

3
  • I am going to ping every 10 minutes or so and hopefully that will fix the dns lookup lag. As mentioned in previous comment, I am using an older version which doesn't have that setting. Correct me if I am wrong.. However, if it is available, setting it to 600 will be the same as the external service TTL. That won't make any difference, will it?
    – perlwle
    Jul 20, 2015 at 15:21
  • 1
    @perlwle No, it would not, I had assumed you always received a TTL of zero, increasing it to 1200 would help. I would suggest looking into DNSCrypt. Without further information as to how long lookups take, your connection speed, and the effects of 3rd parties, I cannot give a clearer answer. If you need a more powerful DNS cache/resolver, I would recommend the basic part of this tutorial about Unbound, it works on Ubuntu 12.04 perfectly well from the standard repositories. (Note that Google DNS properly handles DNSSEC now.)
    – Phizes
    Jul 20, 2015 at 18:18
  • 1
    Also note dnsmasq 'local-ttl' for those host file entries
    – KCD
    Feb 4, 2016 at 8:51
0

Q: Is the timeout based on last reference from client ('hit') or last real lookup to dns server ? If clients keep hitting cache ('hit') often and this updates the last time referenced then a real lookup to dns server will never happen. Assuming clients making getaddinfo() calls constantly, can we force a real lookup to server every 30 seconds or so with --min-cache-ttl set to 30 ? thx

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .