Re: [Zinq-general] Caching SERVFAIL?

Mark Johnson wrote:
> I got this patch (djbdns-dnscache-NCACHE.patch ) via Jason Haar:
>   

I'd recommend against using it now. We had a problem just a few weeks
ago with *1* external DNS server. It looks like it was returning errors
(or timing out - not sure) and this patch caused dnscache to cache the
failed result and apply it to other valid queries that were about to be
sent to the same DNS server (for the next 200 secs).

i.e.

client-queryX -> dnscache -> query -> server
server -> error(or timeout?) -> dnscache (which cached it) ->
appropriate-error-to-client

client-queryY ->  dnscache - > inappropriate-error-to-client-due-to-cache

It was nasty. We ended up triggering SMTP failures due to "no such
host/domain" as the cached value was being applied to MX  and A records.
The problem would manifest itself as email bouncing to valid domains at
random times during the day. All such bounces were from domains that
used this particular DNS server. (stuff the privacy: dns1.clear.net.nz  ;-)

Even with a sniffer, I never could catch any "bad" packets coming back
from this external DNS server - but I did see tonnes of non-replies (I
guess their DNS server is overloaded), which matches the "state == -1"
bit in the patch I guess.

To some extent it could be that the patch is doing exactly what is
intended, but as this external DNS server that I refer to is one of the
largest in New Zealand - and their staff claimed there was nothing wrong
with it - then pragmatism says I have to blame the patch... Perhaps if
the 200 was reduced to "2" - that would still reduce dnscache queries to
non-existent/down DNS servers - but make it much less likely to trigger
the fault we had?




-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1