How to get TTL to update?

openletter

I think I need to understand DNS record updates a little better because I'm not clear on why a record updates to its old time.

This is what I'm seeing:

1. Look up example.com on Firefox in Windows 7 and in Ubuntu Server 12.04, which dig reports the domain has ~1600 left.
2. Change primary DNS server in whois record for example.com
3. Using whois from the Ubuntu Server I can see that the whois record is updated.
4. After TTL has expired, I check again and see that it has reset to the previous server TTL of 1800 and still loads old location in FF

This has happened for several cycles now.

pfSense is configured to use OpenDNS 208.67.220.220 and 208.67.220.222.

openletter

I just found a cache checking feature provided by OpenDNS at http://cachecheck.opendns.com/ and I verified that OpenDNS has the correct, updated IP address for the domain, so, presumably, the updated nameserver and TTL, as well, but pfSense is still delivering the previous IP address and TTL from the previous name server data.

johnpoz

Here is the thing did you check the ttl of the Name Server?

Here is what happens you set a TTL on a NS to say 1 week.. maybe your ttl on your www A record is 1 day. You go and change your nameservers to new ones, but your dns server has it cached and is counting down the ttl.. you at the same time change the IP address of your www A record.. Problem is even though ttl has expired on A, I am still going to go ask the old servers for that record until the TTL of the NS expires or you flush the cache on the name server your using.

Its easy enough to validate any of this just do a query to the authoritative name server in question for whatever domain your working with - and the root servers for whatever tld they are in for the NS record and they will tell you if its been updated by the registrar are not, etc.

What domain are you working with and will check it out.

So the name servers for pfsense.org are

;; QUESTION SECTION:
;pfsense.org. IN NS

;; ANSWER SECTION:
pfsense.org. 1800 IN NS dns5.registrar-servers.com.
pfsense.org. 1800 IN NS dns4.registrar-servers.com.
pfsense.org. 1800 IN NS dns3.registrar-servers.com.
pfsense.org. 1800 IN NS dns2.registrar-servers.com.
pfsense.org. 1800 IN NS dns1.registrar-servers.com.

with a TTL of 1800 seconds or 30 minutes - which is really very short and causing lots of unneeded traffic. Unless they were thinking of changing nameservers shortly that seems a bit low to me.

The TTL of the A record for www is

;; QUESTION SECTION:
;www.pfsense.org. IN A

;; ANSWER SECTION:
www.pfsense.org. 3600 IN A 208.123.73.69

so 1 hours double that of the NS records.

openletter

@johnpoz

Reported in my pfSense dashboard:

DNS server(s)
127.0.0.1
208.67.222.222
208.67.220.220

The last two are the OpenDNS servers.

Initially, using dig on a local Ubuntu server told me that the remaining TTL was ~1600 and that Ubuntu was using the IP address assigned to pfSense as the DNS server.

I then switched the primary DNS record for the domain.

After the switch, using dig from a remote server told me that TTL was 300 and pointing to the new server.

Using the dig tool with the local server I saw the TTL cycle and reset several times.

I then checked the domain using the OpenDNS cache tool, which reported that all of the OpenDNS servers were pointing the domain at the new server, per the updated primary DNS record.

I then saw the local TTL reset back to 1800, continuing to point at the old server.

And then I saw it do this again, after which I went to bed and in the morning it was finally pointing at the new server.

Probing the domain's whois and DNS records wouldn't reveal anything as I'm fairly certain that the issue was internal to my network, given that both my remote server and OpenDNS were reporting the correct DNS record information.

johnpoz

Well with the info you have given me I can not do anything.. You just repeated the gibberish from your first post.

I don't care what outside dns you were using - has no matter once you cache it local.. If you would of given me the actual domain we could look to see what the nameservers, what they were - what the TTLs on the different records are, etc .

I already went over what can happen and why.

openletter

I'm afraid I don't know what you mean by 'gibberish'.

johnpoz

You didn't give any info that would let anyone help you.. What outside server you were using has nothing to do with anything.. Without the actual domain you were talking about your post is just gibberish that you were using opendns, or level3 or your isp, etc.

Need to know what domain you are talking about, and what was their old name servers vs their new ones, etc.