<html><head></head><body style="zoom: 0%;"><div dir="auto">Hi Otto,<br><br></div>
<div dir="auto">Thank you for the clarification. Yes, I'm aware that the source may change, but TTL exists for that. So I don't think this is a valid reason to not sync cache. As the current situation is worse:<br><br></div>
<div dir="auto">Resolver A caches IP address <a href="http://1.1.1.1">1.1.1.1</a> and resolver B caches IP address <a href="http://2.2.2.2">2.2.2.2</a>. Subsequently a user types to navigate to the site, but the firewall happened to resolve the domain via the other resolver. This ends up causing intermittent issues as it ends up being pot luck whether a user happens to use the same resolver that the firewall used.<br><br></div>
<div dir="auto">A cache sync would at least cause the same behaviour for all users. And using a single resolver is too risky.</div>
<div class="gmail_quote" >On 17 Sept 2022, at 15:44, Otto Moerbeek <<a href="mailto:otto@drijf.net" target="_blank">otto@drijf.net</a>> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="blue">Hello,<br><br>cachs syncing is not something we have and even with it (or using a<br>single resolver) there is an issue that records can change:<br>the scenario: <br><br> - a client asks the record, record gets cached<br> - client A asks and gets cached value,<br> - publisher of records changes the record<br> - record expires from cache<br> - client B (firewall) asks and record resolves to different value.<br><br><br>On Sat, Sep 17, 2022 at 01:01:09AM +0100, Djerk Geurts via Pdns-users wrote:<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> Just ran into an issue with recursive DNS servers where the two servers have cached a different A record for <a href="http://mirror.centos.org">mirror.centos.org</a>.<br> <br> This is a problem as the firewalls permit access to the FQDN, which presumes that both the client and the firewall end up with the same A record for the domain.<br> <br> I'm intending to swap these recursors out with PowerDNS servers, but am wondering if there's a way to keep the record cache in sync between multiple recursors.<br> <br> --<br> Best regards,<br> Djerk Geurts<br> m: +44-7535-674620<br> <br> Maizymoo Ltd<br> VAT No: GB192 1529 07<br> Registration Number: 6638104 (registered in England and Wales)<br></blockquote><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"><hr><br> Pdns-users mailing list<br> Pdns-users@mailman.powerdns.com<br> <a href="https://mailman.powerdns.com/mailman/listinfo/pdns-users">https://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br></blockquote><br></pre></blockquote></div></body></html>