Force the recursor to not decrease the TTL

[soulbreak]

Hello the community,

My original problem is that I would like to avoid to have a TTL of 1, as some clients have an issue with this value.
So I tried 2 approach:

• force the recursor the not send 1 as minimum value
• force the recursor to just forward the original authoritative TTL (which is decreasing each second once stored in the cache)

So I tried to configure the minimum-ttl-override and playing arround all ttl/cache relative option without success until now.
I also tried using lua to reset the original ttl in the preresolve function, but the value seems not stored.

I'm using recursor 4.8.9 for the moment. I search around the documentation and the github project without finding a solution until now.

As it seems a not really complex behavior, did I missed something ?

Thank you for your help.

[omoerbeek]

minimum-ttl-override should work to override the minimum value at the moment a record is inserted into the cache. It will count down though over time, there's no way to override that. A recursor cache is required to do that. I'm wondering what kind of buggy client cannot handle TTL 1, they should even be capable of handling TTL 0.

[soulbreak]

Hello, thank you for your answer.
Ok I better understand minimum-ttl-override, and I understand that the oppositive option is max-cache-ttl, to set a upper bound.

If I cannot change the TTL between a defined interval, I will have to disable the recursor-cache in order to not have anymore a decrementation of the TTL. Do oyu know how to do that ? Because I definitely still need other capabilites of the recursor (forwarding and lua scripting)

Unfortunately I do not have a lot of details about the client issue at the moment ; apparently it is a security later they have to avoid refreshing to often. I requested more details, as I'm not in direct contact.

[omoerbeek]

Disabling the recursor cache completely is not possible in general. The recursor needs its cache to be able to store records it needs for resolving, like delegations. With forwarding everything you might get away with it, though. See https://docs.powerdns.com/recursor/settings.html#max-cache-entries

It could be that dnsdist might be a better (part of a) solution for you: https://dnsdist.org/guides/cache.html#caching-responses . It's cache has a "dontAge" setting, in addtion to a minimum TTL.

Another possible solution that comes to my mind is disabling the packetcache and let Lua postresolve modify the TTL. But this is all ugly and might have unwanted side effects.

The root cause is a misbehaving client: adding "security" functionality that breaks normal DNS answers is not very helpful in any way.

[soulbreak]

Ok I better understand, thank you.
I tried max-cache-entries to 0, and the TTL is still decreasing.

I did not installed dnsdist yet, I will give it a try and provide a feedback.
Actually I'm using the ugly solution with lua as a quick workaround.

[omoerbeek]

The record cache is always filled, and pruning is an asynchronous process, where max-cache-entries is a target. In practice there will be more entries cached.

[soulbreak]

Ok thank you again for the clear explanation.

As you pointed out, dnsdist is returning a fix TTL with the option dontAge.

I found that it can bound the TTL between an interval with this action addResponseAction(AllRule(), LimitTTLResponseAction(86360, 86400))

Thank you very much for your help