nxdomain responses include huge timeouts

joohoi / acme-dns

Limited DNS server with RESTful HTTP API to handle ACME DNS challenges easily and securely.

MIT License

2.19k stars 233 forks source link

nxdomain responses include huge timeouts #342

Open Wildcarde opened 1 year ago

Wildcarde commented 1 year ago

There doesn't appear to be a way to set minTTL for nxdomain replies at this time. This would be very helpful to prevent upstream dns servers from breaking how acme-dns works. I'm running into this issue currently with an infoblox based dhcp/dns server upstream. It holds onto the nxdomain reply for an hour+ and never checks back with acme-dns till it's too late and the letsencrypt request has expired.

apeschar commented 1 year ago

I believe that the last field in the SOA record should be set to a much lower value (eg, 1 or 60) to prevent NXDOMAIN responses from being cached for a long term. It's currently 86400, which may lead to NXDOMAIN responses being cached for up to a day.

https://github.com/joohoi/acme-dns/blob/master/dns.go#L65

joohoi commented 1 year ago

Good point, 60sec should be sufficient.