Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop using low DNS TTLs

blog.apnic.net

Post reply on HN
Print view View original

11–20 of 46 posts

Re: Stop using low DNS TTLs

#11

Post by fukawi2 »

garciasn wrote: post #8

Could it be because folks set it low for initial propagation and then never change it back after they set it up.

That's not how TTL works. Or do you mean propagation after changing an existing RR?

It's "common" to lower a TTL in preparation for a change to an existing RR, but you need to make sure you lower it at least as long as the current TTL prior to the change. Keeping the TTL low after the change isn't beneficial unless you're planning for the possibility of reverting the change.

A low TTL on a new record will not speed propagation. Resolvers either have the new record cached or they don't. If it's cached, the TTL doesn't matter because it already has the record (propogated). If it doesn't have it cached, then it doesn't know the TTL so doesn't matter if it's 1 second or 1 month.

Re: Stop using low DNS TTLs

#12

Post by deceptionatd »

garciasn wrote: post #8

Could it be because folks set it low for initial propagation and then never change it back after they set it up.

Maybe, but I don't think TTL matters for speed of initial propagation. I do set it low when I first configure a website so I don't have to wait hours to correct a mistake I might not have noticed.

Re: Stop using low DNS TTLs

#13

Post by deceptionatd »

I have mine set low on some records because I want to be able to change the IP associated with specific RTMP endpoints if a provider goes down. The client software doesn't use multiple A records even if I provide them, so I can't use that approach; and I don't always have remote admin access to the systems in question so I can't just use straight IPs or a hostfile.

Re: Stop using low DNS TTLs

#14

Post by deceptionatd »

BitPirate wrote: post #4
bjourne wrote: post #2

I don't understand why the author doesn't consider load balancing and failover legitimate use cases for low ttl. Cause it wrecks their argument?

Why do you need a low ttl for those? You can add multiple IPs to your A/AAAA records for very basic load balancing. And DNS is a pretty bad idea for any kind of failover. You can set a very low ttl, but providers might simply enforce a larger one.

It's not good as a first line of defense for failover, but with some client software and/or failure mechanisms there aren't any better approachs I'm aware of. Some of the software I administer doesn't understand multiple A/AAAA records.

And a BGP failure is a good example too. It doesn't matter how resilient the failover mechanisms for one IP are if the routing tables are wrong.

Agreed about some providers enforcing a larger one, though. DNS propagation is wildly inconsistent.

Re: Stop using low DNS TTLs

#15

Post by Neywiny »

I guess I'm not sure I understand the solution. I use a low value (idk 15 minutes maybe?) because I don't have a static ip and I don't want that to cause issues. It's just me to my home server so I'm not adding noticable traffic like a real company or something, but what am I supposed to do? Is there a way for me to send an update such that all online caches get updated without needing to wait for them to time out?

Re: Stop using low DNS TTLs

#16

Post by garciasn »

fukawi2 wrote: post #11
garciasn wrote: post #8

Could it be because folks set it low for initial propagation and then never change it back after they set it up.

That's not how TTL works. Or do you mean propagation after changing an existing RR? It's "common" to lower a TTL in preparation for a change to an existing RR, but you need to make sure you lower it at least as long as the current TTL prior to the change. Keeping the TTL low after the change isn't beneficial unless you're planning for the possibility of reverting the change. A low TTL on a new record will not speed p…

I meant both. Initial (which you say doesn't matter; TIL) and edits after-the-fact. I learned something new today and I've been doing DNS crap for decades; I feel like a doofus.

Re: Stop using low DNS TTLs

#18

Post by viraptor »

Neywiny wrote: post #15

I guess I'm not sure I understand the solution. I use a low value (idk 15 minutes maybe?) because I don't have a static ip and I don't want that to cause issues. It's just me to my home server so I'm not adding noticable traffic like a real company or something, but what am I supposed to do? Is there a way for me to send an update such that all online caches get updated without needing to wait for them to time out?

For a private server with not many users this is mostly irrelevant. Use low ttl if you want to, since you're putting basically 0 load on the DNS system.

> such that all online caches get updated

There's no such thing. Apart from millions of dedicated caching servers, each end device will have it's own cache. You can't invalidate DNS entries at that scope.

Re: Stop using low DNS TTLs

#19

Post by tracker1 »

I usually set mine to between an hour and a day, unless I'm planning to update/change them "soon" ... though I've been meaning to go from a /29 to /28 on my main server for a while, just been putting off switching all the domains/addresses over.

Maybe this weekend I'll finally get the energy up to just do it.

Re: Stop using low DNS TTLs

#20

Post by GuinansEyebrows »

i was taught this as a matter of professional courtesy in my first job working for an ISP that did DNS hosting and ran its own DNS servers (15+ years ago). if you have a cutover scheduled, lower the TTL at $cutover_time - $current_ttl. then bring the TTL back up within a day or two in order to minimize DNS chatter. simple!

of course, as internet speeds increase and resources are cheaper to abuse, people lose sight of the downstream impacts of impatience and poor planning.

Post reply on HN