4

This question comes from this topic. When I do this I get the remaining seconds until the A record expires in the queried nameserver:

dig stackexchange.com

However, if I do this I get the authorative TTLs values:

dig any stackexchange.com 

So, I don’t understand why when I do dig any stackexchange.com I get all TTL values as if I did an authorative question, when I actually made a recursive query.

migrated from serverfault.com Feb 4 '15 at 3:47

This question came from our site for system and network administrators.

  • @Kannan Mohan, now it's in a new question. – whitenoisedb Feb 2 '15 at 22:36
7

To be short, Both of the queries you have mentioned in the question are non-authoritative query.

DNS records for a domain can be queried from a caching DNS server or from an authoritative DNS server. So when you want to query a caching DNS server you can either specify the DNS IP address or if not specified, the default DNS server that has been configured in /etc/resolv.conf will be taken.

Non authoritative query

$ dig stackexchange.com

or

$ dig stackexchange.com @8.8.8.8

In above both cases the query returns a non-authoritative reply because your ISP's DNS or Google's public DNS (8.8.8.8) are not authoritative for stackexchange.com domain. As you have queried an non-authoritative nameserver the TTL value it provides will decrease for each time you query it. Once the TTL value expires the caching nameserver will requery the authoritative DNS server.

Authoritative query

So to get an authoritative reply you need to query the record from an authoritative DNS server and which can be found with below method.

$ dig ns stackexchange.com
       ...
;; ANSWER SECTION:
stackexchange.com.  84894   IN  NS  cf-dns02.stackexchange.com.
stackexchange.com.  84894   IN  NS  cf-dns01.stackexchange.com.
       ...

The ANSWER SECTION provides the authoritative nameservers for the domain stackexchange.com and so if we need to get the authoritative reply then

$ dig stackexchange.com @cf-dns01.stackexchange.com.

While we query the authoritative DNS server the TTL values will not change because these Nameservers are the primary source of the information and they dont expire until its administrator changes it.

How ANY record works

ANY record is like a wild-card, you can use it to get all records that are cached/stored in a DNS server. For example I have queried stackexchange.com for ANY record and my default DNS server replies as below.

$ dig any stackexchange.com
    ....
;; ANSWER SECTION:
stackexchange.com.  86350   IN  SOA cf-dns01.stackexchange.com. dns.cloudflare.com. 2017456480 10000 2400 604800 3600
stackexchange.com.  176 IN  A   198.252.206.140
stackexchange.com.  84338   IN  NS  cf-dns01.stackexchange.com.
stackexchange.com.  84338   IN  NS  cf-dns02.stackexchange.com.
    ....

Here you can see that the reply contains only information about SOA, A and NS record. But there are actually more records for stackexchange.com which are not cached in my default DNS server as I havent queried for it.

Now I am querying for MX record to my default DNS server and the reply is as

$ dig MX stackexchange.com
    ....
;; ANSWER SECTION:
stackexchange.com.  300 IN  MX  10 aspmx3.googlemail.com.
stackexchange.com.  300 IN  MX  5 alt2.aspmx.l.google.com.
stackexchange.com.  300 IN  MX  5 alt1.aspmx.l.google.com.
stackexchange.com.  300 IN  MX  10 aspmx2.googlemail.com.
stackexchange.com.  300 IN  MX  1 aspmx.l.google.com.
    ....

Now I again query for ANY record and now you can see that query for ANY has returned MX records too. And so ANY record will just provide records that are only cached on your default nameserver.

$ dig any stackexchange.com
     ....
;; ANSWER SECTION:
stackexchange.com.  298 IN  MX  5 alt1.aspmx.l.google.com.
stackexchange.com.  298 IN  MX  10 aspmx2.googlemail.com.
stackexchange.com.  86084   IN  NS  cf-dns01.stackexchange.com.
stackexchange.com.  298 IN  MX  10 aspmx3.googlemail.com.
stackexchange.com.  298 IN  MX  1 aspmx.l.google.com.
stackexchange.com.  298 IN  MX  5 alt2.aspmx.l.google.com.
stackexchange.com.  86084   IN  NS  cf-dns02.stackexchange.com.
stackexchange.com.  243 IN  A   198.252.206.140
stackexchange.com.  86343   IN  SOA cf-dns01.stackexchange.com. dns.cloudflare.com. 2017456480 10000 2400 604800 3600
     ....

And as you can see the TTL values are changing for non-authoritative replies.

1

You are not understanding the TTL field on DNS queries. The TTL is an indicator for the client how long it should cache the results before re-querying the nameserver again. Unless you update your DNS server with a different value for the TTL, the response will always be the same. It is very bad practice to re-query nameservers every-time you need to resolve a hostname to an IP.

  • I understand that only when querying the authorative servers then TTL indicates how long it should cache the results. However, when doing a recursive query you get the actual remaining time in those DNS server before it restarts. – whitenoisedb Feb 2 '15 at 23:47
  • So why when doing dig somedomain.com I get, for example, 1645? which isn't actually the TTL. If I do an authorative question for that I get the correct TTL value of 14400. – whitenoisedb Feb 2 '15 at 23:54
  • Would you mind specifying the actual command you are using? I suspect that some of the parameters are switching to an iterative query rather than permitting a recursive query. (+norec +nssearch or +trace?) – TheCompWiz Feb 3 '15 at 0:07
  • Say for example, I've just did dig stackexchange.com and TTL was 15. Then if I do dig +norecurse stackexchange.com @cf-dns01.stackexchange.com I get TTL value of 300. – whitenoisedb Feb 3 '15 at 0:13
  • Correct. +norecurse forces queries against the authoritative servers directly. +norecurse by definition does an iterative query. – TheCompWiz Feb 3 '15 at 0:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.