Force low cache time (TTL) for NXDOMAIN responses [Unbound]

[luckman212]

I would like to know if it's possible to force a global TTL of e.g. 1 minute for NXDOMAIN responses to be cached locally by Unbound?

I know about   cache-max-ttl  but I don't want to override valid records that may have a long TTL.  The reason I ask is, occasionally I make DNS changes on a public DNS server and since I use Unbound locally, if I "try too soon" to fetch that new record, the NXDOMAIN response will sometimes get cached in my local Unbound for minutes, hours etc.  Yes I can log on and bounce Unbound but it's tedious.

Anyone know if this is possible? Thanks…

[johnpoz]

So you control the authoritative ns for the domain your looking up?  Is so what did you set the min ttl for in the soa.  If I recall when you get back an nx from an authoritative server the min ttl should be used by the caching server for the neg response.  I believe this is the way unbound works.

Should be simple enough to test/verify this is how it works.

If all your looking to do is flush the neg, you could just do a unbound-control flush_negative this should flush any neg cached items only.

[luckman212]

Thanks for the reply John

Yes in most cases I would control the auth ns.  I was just looking for a way to sledge hammer this from my end instead of having to set low SOA TTLs for hundreds of domains (which might also have other unforeseen consequences)

I will try the unbound-control flush_negative – I could make a quick shell script that runs this when I need to use it if that works.

[johnpoz]

Your other option which I think is prob a better one is just not query to soon.. If you have made some updates on your public servers why would you not just query them direct with say dig or drill or shoot even nslookp before having your caching server look for the records.  Once your direct query responds correctly then can ask your local unbound to look it up, etc.

[luckman212]

Thanks again for the help.  Had to use the following command format but it did the trick

unbound-control -c /var/unbound/unbound.conf flush_negative

[johnpoz]

Great you got it sorted.