Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Force low cache time (TTL) for NXDOMAIN responses [Unbound]

    Scheduled Pinned Locked Moved DHCP and DNS
    6 Posts 2 Posters 2.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • luckman212L
      luckman212 LAYER 8
      last edited by

      I would like to know if it's possible to force a global TTL of e.g. 1 minute for NXDOMAIN responses to be cached locally by Unbound?

      I know about   cache-max-ttl  but I don't want to override valid records that may have a long TTL.  The reason I ask is, occasionally I make DNS changes on a public DNS server and since I use Unbound locally, if I "try too soon" to fetch that new record, the NXDOMAIN response will sometimes get cached in my local Unbound for minutes, hours etc.  Yes I can log on and bounce Unbound but it's tedious.

      Anyone know if this is possible? Thanks…

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        So you control the authoritative ns for the domain your looking up?  Is so what did you set the min ttl for in the soa.  If I recall when you get back an nx from an authoritative server the min ttl should be used by the caching server for the neg response.  I believe this is the way unbound works.

        Should be simple enough to test/verify this is how it works.

        If all your looking to do is flush the neg, you could just do a unbound-control flush_negative this should flush any neg cached items only.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • luckman212L
          luckman212 LAYER 8
          last edited by

          Thanks for the reply John

          Yes in most cases I would control the auth ns.  I was just looking for a way to sledge hammer this from my end instead of having to set low SOA TTLs for hundreds of domains (which might also have other unforeseen consequences)

          I will try the unbound-control flush_negative – I could make a quick shell script that runs this when I need to use it if that works.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            Your other option which I think is prob a better one is just not query to soon.. If you have made some updates on your public servers why would you not just query them direct with say dig or drill or shoot even nslookp before having your caching server look for the records.  Once your direct query responds correctly then can ask your local unbound to look it up, etc.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • luckman212L
              luckman212 LAYER 8
              last edited by

              Thanks again for the help.  Had to use the following command format but it did the trick

              unbound-control -c /var/unbound/unbound.conf flush_negative
              
              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                Great you got it sorted.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post
                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.