• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

How to get TTL to update?

DHCP and DNS
2
7
1.4k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • O
    openletter
    last edited by Sep 16, 2014, 1:52 AM

    I think I need to understand DNS record updates a little better because I'm not clear on why a record updates to its old time.

    This is what I'm seeing:

    1. Look up example.com on Firefox in Windows 7 and in Ubuntu Server 12.04, which dig reports the domain has ~1600 left.
    2. Change primary DNS server in whois record for example.com
    3. Using whois from the Ubuntu Server I can see that the whois record is updated.
    4. After TTL has expired, I check again and see that it has reset to the previous server TTL of 1800 and still loads old location in FF

    This has happened for several cycles now.

    pfSense is configured to use OpenDNS 208.67.220.220 and 208.67.220.222.

    pfSense 2.4.3-RELEASE (amd64) installed to PC on Samsung 860 EVO mSATA 256 GB SSD with Supermicro X11SBA-LN4F, Intel Pentium N3700, 4 GB RAM, 4 mobo 10/100/1000, 1 PCIe 10/100/1000 x4 NIC (HP NC364T), and APC Smart-UPS SMT1500.

    1 Reply Last reply Reply Quote 0
    • O
      openletter
      last edited by Sep 16, 2014, 3:17 AM

      I just found a cache checking feature provided by OpenDNS at http://cachecheck.opendns.com/ and I verified that OpenDNS has the correct, updated IP address for the domain, so, presumably, the updated nameserver and TTL, as well, but pfSense is still delivering the previous IP address and TTL from the previous name server data.

      pfSense 2.4.3-RELEASE (amd64) installed to PC on Samsung 860 EVO mSATA 256 GB SSD with Supermicro X11SBA-LN4F, Intel Pentium N3700, 4 GB RAM, 4 mobo 10/100/1000, 1 PCIe 10/100/1000 x4 NIC (HP NC364T), and APC Smart-UPS SMT1500.

      1 Reply Last reply Reply Quote 0
      • J
        johnpoz LAYER 8 Global Moderator
        last edited by Sep 21, 2014, 11:38 AM Sep 21, 2014, 11:32 AM

        Here is the thing did you check the ttl of the Name Server?

        Here is what happens you set a TTL on a NS to say 1 week..  maybe your ttl on your www A record is 1 day.  You go and change your nameservers to new ones, but your dns server has it cached and is counting down the ttl.. you at the same time change the IP address of your www A record..  Problem is even though ttl has expired on A, I am still going to go ask the old servers for that record until the TTL of the NS expires or you flush the cache on the name server your using.

        Its easy enough to validate any of this just do a query to the authoritative name server in question for whatever domain your working with - and the root servers for whatever tld they are in for the NS record and they will tell you if its been updated by the registrar are not, etc.

        What domain are you working with and will check it out.

        So the name servers for pfsense.org are

        ;; QUESTION SECTION:
        ;pfsense.org.                  IN      NS

        ;; ANSWER SECTION:
        pfsense.org.            1800    IN      NS      dns5.registrar-servers.com.
        pfsense.org.            1800    IN      NS      dns4.registrar-servers.com.
        pfsense.org.            1800    IN      NS      dns3.registrar-servers.com.
        pfsense.org.            1800    IN      NS      dns2.registrar-servers.com.
        pfsense.org.            1800    IN      NS      dns1.registrar-servers.com.

        with a TTL of 1800 seconds or 30 minutes - which is really very short and causing lots of unneeded traffic.  Unless they were thinking of changing nameservers shortly that seems a bit low to me.

        The TTL of the A record for www is

        ;; QUESTION SECTION:
        ;www.pfsense.org.              IN      A

        ;; ANSWER SECTION:
        www.pfsense.org.        3600    IN      A      208.123.73.69

        so 1 hours double that of the NS records.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        1 Reply Last reply Reply Quote 0
        • O
          openletter
          last edited by Sep 21, 2014, 5:56 PM

          @johnpoz

          Reported in my pfSense dashboard:

          DNS server(s)
          127.0.0.1
          208.67.222.222
          208.67.220.220

          The last two are the OpenDNS servers.

          Initially, using dig on a local Ubuntu server told me that the remaining TTL was ~1600 and that Ubuntu was using the IP address assigned to pfSense as the DNS server.

          I then switched the primary DNS record for the domain.

          After the switch, using dig from a remote server told me that TTL was 300 and pointing to the new server.

          Using the dig tool with the local server I saw the TTL cycle and reset several times.

          I then checked the domain using the OpenDNS cache tool, which reported that all of the OpenDNS servers were pointing the domain at the new server, per the updated primary DNS record.

          I then saw the local TTL reset back to 1800, continuing to point at the old server.

          And then I saw it do this again, after which I went to bed and in the morning it was finally pointing at the new server.

          Probing the domain's whois and DNS records wouldn't reveal anything as I'm fairly certain that the issue was internal to my network, given that both my remote server and OpenDNS were reporting the correct DNS record information.

          pfSense 2.4.3-RELEASE (amd64) installed to PC on Samsung 860 EVO mSATA 256 GB SSD with Supermicro X11SBA-LN4F, Intel Pentium N3700, 4 GB RAM, 4 mobo 10/100/1000, 1 PCIe 10/100/1000 x4 NIC (HP NC364T), and APC Smart-UPS SMT1500.

          1 Reply Last reply Reply Quote 0
          • J
            johnpoz LAYER 8 Global Moderator
            last edited by Sep 21, 2014, 7:15 PM

            Well with the info you have given me I can not do anything..  You just repeated the gibberish from your first post.

            I don't care what outside dns you were using - has no matter once you cache it local..  If you would of given me the actual domain we could look to see what the nameservers, what they were - what the TTLs on the different records are, etc .

            I already went over what can happen and why.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            1 Reply Last reply Reply Quote 0
            • O
              openletter
              last edited by Sep 21, 2014, 8:31 PM

              I'm afraid I don't know what you mean by 'gibberish'.

              pfSense 2.4.3-RELEASE (amd64) installed to PC on Samsung 860 EVO mSATA 256 GB SSD with Supermicro X11SBA-LN4F, Intel Pentium N3700, 4 GB RAM, 4 mobo 10/100/1000, 1 PCIe 10/100/1000 x4 NIC (HP NC364T), and APC Smart-UPS SMT1500.

              1 Reply Last reply Reply Quote 0
              • J
                johnpoz LAYER 8 Global Moderator
                last edited by Sep 21, 2014, 8:38 PM

                You didn't give any info that would let anyone help you..  What outside server you were using has nothing to do with anything..  Without the actual domain you were talking about your post is just gibberish that you were using opendns, or level3 or your isp, etc.

                Need to know what domain you are talking about, and what was their old name servers vs their new ones, etc.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                1 Reply Last reply Reply Quote 0
                1 out of 7
                • First post
                  1/7
                  Last post
                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.