DNS Resolver (unbound) cache - do items ever get removed?
-
I have "Prefetch Support" turned on in the DNS Resolver settings. I thought that this would make DNS resolved names never get removed from the cache, but instead automatically refreshed when their time was close to expiring. But today in Chrome dev tools I noticed that a name for a site that I had visited just yesterday has a few 10's of ms DNS resolution time, indicating that it didn't come from my cache. What gives? Do items get removed from the cache even with this setting turned on? I turned up several of the cache size settings so I don't think that's the problem, but I'm not sure how I could tell.
-
I did it.
I stumped the pfSense community.
-
You don't understand how the prefetch works.
It will only look it up or prefetch if a record if a client request that record and the ttl is within 10% of expiration.
So lets say www.domain.com had a ttl of 600 seconds
Client asks for www.domain.com while the ttl is at 300 seconds.. You get that record returned to you.. no prefetch only at 50% of the ttl.
Now another client comes in and asks for www.domain.com while there is say 59 seconds left on the ttl.. Client will get their answer, and then unbound will go resolve www.domain.com again to refresh the cache.
All prefetch does is keep popular items in the cache from expiring..
-
Thank you for that explanation, you're right, I didn't understand how the feature worked.
For a small network, which is unlikely to have a client make a request within that 10% timeframe, but where I still desire to benefit from caching of name requests that the network has used before, is there any way to have the records automatically refreshed?
-
You could write some sort of script to run through your popular fqdn… I recall someone around here being obsessed with such nonsense.
He was trying to load like 100's if not 1000's of them.. He posted his "solution" I do believe..
I don't see such a need, the difference between a cached lookup and none cached should be a few ms.. If your on a connection where doing a full lookup from roots down, ie resolving is so slow you have issues then maybe use of a forwarder is better suited for your connection. Or manipulate the max and min ttls unbound works with..
What is the time to resolve your popular sites, vs a cached response.. Lets say its crazy 300ms to fully resolve.. Your talking .3 of second - how is that an issue? Normally since NS and the tld servers are cached.. So you most likely only need to look up the actual A record from the authoritative NS anyway. So what 30 ms vs the 1-3 ms from cache. So .03 seconds ;)
