<meta http-equiv="Content-Type" content="text/html; charset=utf-8"><div dir="ltr"><div>Hi,</div><div><br></div><div>Thank you for the information and clarification.</div><div>Although I would still like to have a separate ttl for negative caching regardless of what is set for min-cache-ttl, maybe a note on the man page to note this behavior for the community. <br></div><div>Thanks!<br>
</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Sep 21, 2022 at 7:45 AM Simon Kelley <<a href="mailto:simon@thekelleys.org.uk">simon@thekelleys.org.uk</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
<br>
On 20/09/2022 23:54, Glenn Fowler wrote:<br>
> Hi,<br>
> <br>
> I am caching positive responses for 40 minutes (min-cache-ttl), but want <br>
> negative responses cached for only 1 minute. If the forward zone server <br>
> is down momentarily, all of the queries during that time could result in <br>
> an erroneous negative response that gets cached for 40 minutes and <br>
> unreachable during that time instead of the desired 1 minute.<br>
<br>
This is not the case: you need to distinguish between a reply which <br>
says "this domain/RR does not exist" and no response or an error from <br>
the server. The later is never cached. If the forward zone server is <br>
down it can't answer and so can't put anything in the cache.<br>
<br>
> <br>
> With neg-ttl working as expected, a retry after the 1 minute mark would <br>
> result in a positive response.<br>
<br>
See above, in this case there will be error responses until the upstream <br>
server recovers.<br>
<br>
> <br>
> In general, negative responses shouldn't have a high TTL.<br>
<br>
neg-ttl is only a fall-back should a negative response not contain TTL <br>
information, so making it override min-cache-ttl won't affect the normal <br>
case where negative repliues have an SOA record which specifies the TTL.<br>
<br>
There might be an argument for not making min-cache-ttl apply to <br>
negative caching, but I'm not sure that makes sense. min-cache-ttl is a <br>
dangerous option which comes with caveats anyway, if it breaks stuff, <br>
just switch it off.<br>
<br>
Simon.<br>
<br>
> <br>
> On Tue, Sep 20, 2022 at 4:59 PM Geert Stappers via Dnsmasq-discuss <br>
> <<a href="mailto:dnsmasq-discuss@lists.thekelleys.org.uk" target="_blank">dnsmasq-discuss@lists.thekelleys.org.uk</a> <br>
> <mailto:<a href="mailto:dnsmasq-discuss@lists.thekelleys.org.uk" target="_blank">dnsmasq-discuss@lists.thekelleys.org.uk</a>>> wrote:<br>
> <br>
> On Tue, Sep 20, 2022 at 10:41:29AM -0400, Glenn Fowler wrote:<br>
> > Hello,<br>
> ><br>
> > I have observed that if min-cache-ttl time is greater than<br>
> neg-ttl time,<br>
> > then the neg-ttl time is ignored and negative responses are<br>
> cached at the<br>
> > min-cache-ttl time.<br>
> ><br>
> > The expected behavior should be that neg-ttl is independent of<br>
> > min-cache-ttl.<br>
> <br>
> What are the negative effects of it? (a.k.a. With which priority needs<br>
> it further attention?)<br>
> <br>
> <br>
> > In searching I did find that unbound had the exact same issue:<br>
> > <a href="https://github.com/NLnetLabs/unbound/issues/533" rel="noreferrer" target="_blank">https://github.com/NLnetLabs/unbound/issues/533</a><br>
> <<a href="https://github.com/NLnetLabs/unbound/issues/533" rel="noreferrer" target="_blank">https://github.com/NLnetLabs/unbound/issues/533</a>><br>
> ><br>
> > I am on v2.86 on OpenWrt<br>
> ><br>
> > Thank you<br>
> <br>
> Thanks for what?<br>
> <br>
> <br>
> Groeten<br>
> Geert Stappers<br>
> -- <br>
> Silence is hard to parse<br>
> <br>
> _______________________________________________<br>
> Dnsmasq-discuss mailing list<br>
> <a href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk" target="_blank">Dnsmasq-discuss@lists.thekelleys.org.uk</a><br>
> <mailto:<a href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk" target="_blank">Dnsmasq-discuss@lists.thekelleys.org.uk</a>><br>
> <a href="https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss" rel="noreferrer" target="_blank">https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss</a><br>
> <<a href="https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss" rel="noreferrer" target="_blank">https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss</a>><br>
> <br>
> <br>
> _______________________________________________<br>
> Dnsmasq-discuss mailing list<br>
> <a href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk" target="_blank">Dnsmasq-discuss@lists.thekelleys.org.uk</a><br>
> <a href="https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss" rel="noreferrer" target="_blank">https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss</a><br>
<br>
_______________________________________________<br>
Dnsmasq-discuss mailing list<br>
<a href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk" target="_blank">Dnsmasq-discuss@lists.thekelleys.org.uk</a><br>
<a href="https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss" rel="noreferrer" target="_blank">https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss</a><br>
</blockquote></div>