1

I'm confused about the responses I'm getting doing a DNS query using authoritative vs non-authoritative and I'd appreciate you can help clarify.

When I query www.google.com using the authoritative server:

nslookup -debug www.google.com ns1.google.com

ANSWERS:
    ->  www.google.com
        internet address = 172.217.195.147
        ttl = 300 (5 mins)

When I query www.google.com using a non-authoritative server:

nslookup -debug www.google.com 8.8.8.8

ANSWERS:
    ->  www.google.com
        internet address = 216.58.192.132
        ttl = 235 (3 mins 55 secs)

As you can see the TTL of the authoritative server is the raw value of 300 but the TTL of the non-authoritative is the value showing how much time is left before it expires (it is counting down).

  1. For the non-authoritative case, is the TTL really coming from the non-authoritative server or is that somehow showing the cache on my system?

  2. If someone is using a non-authoritative server for as their DNS resolver, then does that mean they must honor what is returned so in the case where 1 is returned for TTL they must refresh again after 1 second ?

3
  1. If the queried value is not in the cache of the non-authoritative server, it will fetch the value from the authoritative server. This server will specify a TTL, in this case 300. The non-authoritative server will then return this answer with a TTL of 300. If 100 seconds later, the same value is queried again, the non-authoritative server will find it in the cache, but because 100 seconds have elapsed, it will return the answer with a TTL of 200 (300-100).

  2. Yes, if the remaining TTL was 1, then the entry expires after 1 second and must be refreshed. As the value also expired in the cache of the non-authoritative server, the non-authoritative server will again query the authoritative server, and will return the answer with a TTL of 300.

    A TTL of 1 when the original TTL was 300 means the authoritative server was queried 299 seconds ago (300-1) and that there is just one second of the originally granted TTL left.

Basically, every answer the authoritative server gave at any time will expire after 300 seconds, wherever it may be cached, in a non-authoritative server, in a resolver that queried the non-authoritative server, and so on.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.