Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    DNS Resolver (unbound) cache - do items ever get removed?

    DHCP and DNS
    2
    5
    2483
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      scurrier last edited by

      I have "Prefetch Support" turned on in the DNS Resolver settings.  I thought that this would make DNS resolved names never get removed from the cache, but instead automatically refreshed when their time was close to expiring.  But today in Chrome dev tools I noticed that a name for a site that I had visited just yesterday has a few 10's of ms DNS resolution time, indicating that it didn't come from my cache.  What gives?  Do items get removed from the cache even with this setting turned on?  I turned up several of the cache size settings so I don't think that's the problem, but I'm not sure how I could tell.

      1 Reply Last reply Reply Quote 0
      • S
        scurrier last edited by

        I did it.

        I stumped the pfSense community.

        1 Reply Last reply Reply Quote 0
        • johnpoz
          johnpoz LAYER 8 Global Moderator last edited by

          You don't understand how the prefetch works.

          It will only look it up or prefetch if a record if a client request that record and the ttl is within 10% of expiration.

          So lets say www.domain.com had a ttl of 600 seconds

          Client asks for www.domain.com while the ttl is at 300 seconds..  You get that record returned to you.. no prefetch only at 50% of the ttl.

          Now another client comes in and asks for www.domain.com while there is say 59 seconds left on the ttl.. Client will get their answer, and then unbound will go resolve www.domain.com again to refresh the cache.

          All prefetch does is keep popular items in the cache from expiring..

          1 Reply Last reply Reply Quote 0
          • S
            scurrier last edited by

            Thank you for that explanation, you're right, I didn't understand how the feature worked.

            For a small network, which is unlikely to have a client make a request within that 10% timeframe, but where I still desire to benefit from caching of name requests that the network has used before, is there any way to have the records automatically refreshed?

            1 Reply Last reply Reply Quote 0
            • johnpoz
              johnpoz LAYER 8 Global Moderator last edited by

              You could write some sort of script to run through your popular fqdn… I recall someone around here being obsessed with such nonsense.

              He was trying to load like 100's if not 1000's of them..  He posted his "solution" I do believe..

              I don't see such a need, the difference between a cached lookup and none cached should be a few ms..  If your on a connection where doing a full lookup from roots down, ie resolving is so slow you have issues then maybe use of a forwarder is better suited for your connection.  Or manipulate the max and min ttls unbound works with..

              What is the time to resolve your popular sites, vs a cached response..  Lets say its crazy 300ms to fully resolve.. Your talking .3 of second - how is that an issue?  Normally since NS and the tld servers are cached..  So you most likely only need to look up the actual A record from the authoritative NS anyway.  So what 30 ms vs the 1-3 ms from cache.  So .03 seconds ;)

              1 Reply Last reply Reply Quote 0
              • First post
                Last post

              Products

              • Platform Overview
              • TNSR
              • pfSense Plus
              • Appliances

              Services

              • Training
              • Professional Services

              Support

              • Subscription Plans
              • Contact Support
              • Product Lifecycle
              • Documentation

              News

              • Media Coverage
              • Press
              • Events

              Resources

              • Blog
              • FAQ
              • Find a Partner
              • Resource Library
              • Security Information

              Company

              • About Us
              • Careers
              • Partners
              • Contact Us
              • Legal
              Our Mission

              We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

              Subscribe to our Newsletter

              Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

              © 2021 Rubicon Communications, LLC | Privacy Policy