3

Is there a tool for Linux that can "persist" IP address during DNS server fail? So domain can be still resolvable on this machine despite of remote DNS server temporary fail.

The scenario is that I have a machine with my web application deployed on it. The application has to connect to remote resource. This resource is not under my control - it is third party Web Service provided by other company, but it is under my client's domain name. Client's DNS servers fail from time to time, so my application cannot resolve domain name, but this third party WS is still available (client's DNS fail is irrelevant to it), so I could reach it by IP and do my job.

So I am looking for tool (DNS cache?) that will resolve domain names through DNS as long as DNS server is up and will return last obtained value when DNS server is down. Reducing DNS requests count is not what I am interested in this scenario, so "classic" DNS cache is not a solution here (I think).


EDIT:

Scenario with local DNS cache that will not work for me:
1. remote DNS is working well
2. local DNS cache is caching the response from remote DNS
3. before TTL of response expires, remote DNS collapses
4. until TTL of response expires, cache provides cached response; so far, so good
5. TTL of response expires, cache flushes entry and cannot obtain new response, because remote DNS is still down; this is not good

  • 2
    Any caching DNS server on your local network or local machine should do, at least until the various TTLs of the zone in question expire – ivanivan Oct 17 '17 at 12:55
  • @ivanivan Thank you for reply. I edited my question and added scenario in which your suggestions will not work. Sorry for not being clear enough previously. – krzys Oct 18 '17 at 14:18
  • I would find an alternative to such an unreliable 3rd party service in this case. If the 3rd party cannot handle such basic things as proper DNS configuration, it doesn't deserve any users... – Tero Kilkanen Oct 21 '17 at 11:25
  • @TeroKilkanen As in description: not reliable part of infrastructure is a DNS system of my client. 3rd party web service is reliable enough, but not always reachable because of my clients DNS system failures. – krzys Oct 24 '17 at 20:04
  • I was referring to the DNS provider as unreliable third party, which should be changed. – Tero Kilkanen Oct 24 '17 at 20:08
6

As others have suggested, the closest you're going to come is an on-server cache, either nscd or a local recursive server. That said, there are a number of problems with this approach:

  • By default, these solutions are not configured to remember names indefinitely (as you are asking), and will expire cached entries per the TTL associated with the individual DNS records. Many records have short TTLs in the neighborhood of five minutes.
  • The software may not allow you to enforce a "minimum TTL" policy that prevents the data from expiring.
  • Even if the software does allow you to enforce a minimum TTL, this introduces its own problems. Some records have short TTLs for a reason. Ignoring those short TTLs may cause unexpected issues.

Ultimately what you're asking for is for nameservers to remember the last known non-error response, which is not a feature that currently exists in the DNS space. There is currently a draft standard in the works to address this due to the increasing popularity of targeting authoritative DNS systems with DDoS attacks. We may start seeing implementations of this in the near future once it moves past the draft status.

4

Whilst I've never used it myself, the unbound caching resolver has a serve-expired setting which sounds like it might fit the bill:

If enabled, unbound attempts to serve old responses from cache with a TTL of 0 in the response without waiting for the actual resolution to finish. The actual resolution answer ends up in the cache later on. Default is "no".

What might trip you up is that when the "actual resolution answer" is SERVRFAIL, that'll expire the entry. It shouldn't take much effort to test that, though.

2

One could make a program that regularly queries the remote hostname using DNS, and then updates local /etc/hosts file with the information.

The end result is that the /etc/hosts file acts as a local cache for the domain name IP, and the application will use that as the source for the IP address.

I don't know any off-the-shelf software that could do this though.

  • That is what my team decided to do. However I am looking for holistic solution i.e. something that can be made a common Chef receipt and installed on each server. – krzys Oct 19 '17 at 19:42
  • @krzys Well, you could write a common script which does this, and deploy it via chef on each machine needing it. Could you elaborate why this doesn't work? || Apart from that, I like this idea a lot, therefore +1! – gf_ Oct 19 '17 at 21:07
  • @gf_ This works for particular hostname only - the script can query DNS for particular hostname, it cannot ask for whatever hostname is needed now or in future. It cannot query for every hostname that exists in the internet and populate /etc/hosts with the answers. By "holistic" solution I mean that I can install it on any server I manage for any product we have and I don't need to bother which hostname will be needed on this server. However, this solution works, but needs managing. – krzys Oct 19 '17 at 22:38
  • Actually your original question is different than the comment you posted over here. It was written on the question that there is a single service whose IP address information needs to be available permanently... – Tero Kilkanen Oct 20 '17 at 4:38
  • @krzys Like Tero said... Your described use case sounds too me quite theoretical, and in any case different from your original question. – gf_ Oct 20 '17 at 6:51
1

Yes, that's possible for example via nscd, the name service cache daemon, which

is a daemon that provides a cache for the most common name service requests.

  • This won't help for short TTLs unfortunately. – Andrew B Oct 17 '17 at 16:56
  • @gf_ Thank you for reply. I edited my question and added scenario. I looked on nscd and I didn't find solution for this scenario. Sorry for not being clear enough previously. – krzys Oct 18 '17 at 14:21
-2

Take a look at your distribution. I know Ubuntu (>=12.04) and brethren already have a dnsmasq DNS server on their local boxes for doing caching and doing other DNS trickery. You may may be able to harness something like that to make DNS cache have longer caching/TTL times.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.