[Pdns-users] Strange recursor TTL behaviour for specific host

Thu Apr 12 14:28:03 UTC 2012

Hi,

We have some trouble resolving a particular record using some of our pdns-recursors, 
especially the ones that run 3.1.7.2 from the Epel repo @ CentOS5 x86_64 (yes, old !)

When we do : dig A risicomanagementacademie-nl.mail.eo.outlook.com. @127.0.0.1

We sometimes get a response, and that returns for example :

;; ANSWER SECTION:
risicomanagementacademie-nl.mail.eo.outlook.com. 32 IN A 65.55.88.22
risicomanagementacademie-nl.mail.eo.outlook.com. 32 IN A 216.32.180.22

When the TTL counts down to 0, we then get a lot of SERVFAILS when trying to query for this record.
And then after a while (~ 2 minutes I believe), it starts all over again.

The funny thing is, is that another box running an old Fedora with a self-built RPM of 3.1.7.2, 
is not showing this behaviour.
Likewise, a 3.1.7.2 on an (again old) FreeBSD 7.3 machine also does not seem to show this behaviour.
Both are 32-bit machines.

So, I took another CentOS5 x86_64 machine, and tried the 3.3.1 RPM's from Kees Monshouer.

No longer SERVFAILS (eg. always a response with A records), but I noticed that the TTL's are shifting.
Tried the same with a rebuild of 3.4-pre source code, and also with latest code from SVN.
No change in behaviour.

This is what I see for example :

http://pastebin.com/sDeggiqx

Here from another test, with disable-packetcache=yes & trace=on in recursor.conf :

Apr 12 16:12:34 blackbox pdns_recursor[14519]: 1 [2] question for 'risicomanagementacademie-nl.mail.eo.outlook.com.|A' from 127.0.0.1
Apr 12 16:12:34 blackbox pdns_recursor[14519]: [2] risicomanagementacademie-nl.mail.eo.outlook.com.: Looking for CNAME cache hit of 'risicomanagementacademie-nl.mail.eo.outlook.com.|CNAME'
Apr 12 16:12:34 blackbox pdns_recursor[14519]: [2] risicomanagementacademie-nl.mail.eo.outlook.com.: No CNAME cache hit of 'risicomanagementacademie-nl.mail.eo.outlook.com.|CNAME' found
Apr 12 16:12:34 blackbox pdns_recursor[14519]: [2] risicomanagementacademie-nl.mail.eo.outlook.com.: Found cache hit for A: 216.32.180.22[ttl=37] 65.55.88.22[ttl=37]
Apr 12 16:12:34 blackbox pdns_recursor[14519]: 1 [2] answer to question 'risicomanagementacademie-nl.mail.eo.outlook.com.|A': 2 answers, 0 additional, took 0 packets, 0 throttled, 0 timeouts, 0 tcp connections, rcode=0
Apr 12 16:12:37 blackbox pdns_recursor[14519]: 1 [3] question for 'risicomanagementacademie-nl.mail.eo.outlook.com.|A' from 127.0.0.1
Apr 12 16:12:37 blackbox pdns_recursor[14519]: [3] risicomanagementacademie-nl.mail.eo.outlook.com.: Looking for CNAME cache hit of 'risicomanagementacademie-nl.mail.eo.outlook.com.|CNAME'
Apr 12 16:12:37 blackbox pdns_recursor[14519]: [3] risicomanagementacademie-nl.mail.eo.outlook.com.: No CNAME cache hit of 'risicomanagementacademie-nl.mail.eo.outlook.com.|CNAME' found
Apr 12 16:12:37 blackbox pdns_recursor[14519]: [3] risicomanagementacademie-nl.mail.eo.outlook.com.: Found cache hit for A: 216.32.180.22[ttl=34] 65.55.88.22[ttl=34]
Apr 12 16:12:37 blackbox pdns_recursor[14519]: 1 [3] answer to question 'risicomanagementacademie-nl.mail.eo.outlook.com.|A': 2 answers, 0 additional, took 0 packets, 0 throttled, 0 timeouts, 0 tcp connections, rcode=0
Apr 12 16:12:41 blackbox pdns_recursor[14519]: 1 [4] question for 'risicomanagementacademie-nl.mail.eo.outlook.com.|A' from 127.0.0.1
Apr 12 16:12:41 blackbox pdns_recursor[14519]: [4] risicomanagementacademie-nl.mail.eo.outlook.com.: Looking for CNAME cache hit of 'risicomanagementacademie-nl.mail.eo.outlook.com.|CNAME'
Apr 12 16:12:41 blackbox pdns_recursor[14519]: [4] risicomanagementacademie-nl.mail.eo.outlook.com.: No CNAME cache hit of 'risicomanagementacademie-nl.mail.eo.outlook.com.|CNAME' found
Apr 12 16:12:41 blackbox pdns_recursor[14519]: [4] risicomanagementacademie-nl.mail.eo.outlook.com.: Found cache hit for A: 216.32.180.22[ttl=30] 65.55.88.22[ttl=30]
Apr 12 16:12:41 blackbox pdns_recursor[14519]: 1 [4] answer to question 'risicomanagementacademie-nl.mail.eo.outlook.com.|A': 2 answers, 0 additional, took 0 packets, 0 throttled, 0 timeouts, 0 tcp connections, rcode=0
Apr 12 16:12:44 blackbox pdns_recursor[14519]: 1 [5] question for 'risicomanagementacademie-nl.mail.eo.outlook.com.|A' from 127.0.0.1
Apr 12 16:12:44 blackbox pdns_recursor[14519]: [5] risicomanagementacademie-nl.mail.eo.outlook.com.: Looking for CNAME cache hit of 'risicomanagementacademie-nl.mail.eo.outlook.com.|CNAME'
Apr 12 16:12:44 blackbox pdns_recursor[14519]: [5] risicomanagementacademie-nl.mail.eo.outlook.com.: No CNAME cache hit of 'risicomanagementacademie-nl.mail.eo.outlook.com.|CNAME' found
Apr 12 16:12:44 blackbox pdns_recursor[14519]: [5] risicomanagementacademie-nl.mail.eo.outlook.com.: Found cache hit for A: 216.32.180.22[ttl=27] 65.55.88.22[ttl=27]
Apr 12 16:12:44 blackbox pdns_recursor[14519]: 1 [5] answer to question 'risicomanagementacademie-nl.mail.eo.outlook.com.|A': 2 answers, 0 additional, took 0 packets, 0 throttled, 0 timeouts, 0 tcp connections, rcode=0
Apr 12 16:12:47 blackbox pdns_recursor[14519]: 1 [6] question for 'risicomanagementacademie-nl.mail.eo.outlook.com.|A' from 127.0.0.1
Apr 12 16:12:47 blackbox pdns_recursor[14519]: [6] risicomanagementacademie-nl.mail.eo.outlook.com.: Looking for CNAME cache hit of 'risicomanagementacademie-nl.mail.eo.outlook.com.|CNAME'
Apr 12 16:12:47 blackbox pdns_recursor[14519]: [6] risicomanagementacademie-nl.mail.eo.outlook.com.: No CNAME cache hit of 'risicomanagementacademie-nl.mail.eo.outlook.com.|CNAME' found
Apr 12 16:12:47 blackbox pdns_recursor[14519]: [6] risicomanagementacademie-nl.mail.eo.outlook.com.: Found cache hit for A: 216.32.180.22[ttl=24] 65.55.88.22[ttl=24]
Apr 12 16:12:47 blackbox pdns_recursor[14519]: 1 [6] answer to question 'risicomanagementacademie-nl.mail.eo.outlook.com.|A': 2 answers, 0 additional, took 0 packets, 0 throttled, 0 timeouts, 0 tcp connections, rcode=0
Apr 12 16:12:49 blackbox pdns_recursor[14519]: 0 [3] question for 'risicomanagementacademie-nl.mail.eo.outlook.com.|A' from 127.0.0.1
Apr 12 16:12:49 blackbox pdns_recursor[14519]: [3] risicomanagementacademie-nl.mail.eo.outlook.com.: Looking for CNAME cache hit of 'risicomanagementacademie-nl.mail.eo.outlook.com.|CNAME'
Apr 12 16:12:49 blackbox pdns_recursor[14519]: [3] risicomanagementacademie-nl.mail.eo.outlook.com.: No CNAME cache hit of 'risicomanagementacademie-nl.mail.eo.outlook.com.|CNAME' found
Apr 12 16:12:49 blackbox pdns_recursor[14519]: [3] risicomanagementacademie-nl.mail.eo.outlook.com.: Found cache hit for A: 216.32.180.22[ttl=32] 65.55.88.22[ttl=32]
Apr 12 16:12:49 blackbox pdns_recursor[14519]: 0 [3] answer to question 'risicomanagementacademie-nl.mail.eo.outlook.com.|A': 2 answers, 0 additional, took 0 packets, 0 throttled, 0 timeouts, 0 tcp connections, rcode=0

As you can see, TTL 37 -> 34 -> 30 -> 27 -> 24 -> 32

I'm wondering what could be causing this ?

I'd assume that the recursor would keep the record in it's cache until the TTL of the record would expire...

Thanks for any helpful insight :)

Best regards,

Wouter