mirror of
https://github.com/acme-dns/acme-dns.git
synced 2026-04-27 04:45:48 +03:00
[GH-ISSUE #342] nxdomain responses include huge timeouts #188
Labels
No labels
Documentation
Documentation
bug
enhancement
feature request
feature request
help wanted
pull-request
question
security
security
testing
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/acme-dns#188
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Wildcarde on GitHub (Jun 13, 2023).
Original GitHub issue: https://github.com/acme-dns/acme-dns/issues/342
There doesn't appear to be a way to set minTTL for nxdomain replies at this time. This would be very helpful to prevent upstream dns servers from breaking how acme-dns works. I'm running into this issue currently with an infoblox based dhcp/dns server upstream. It holds onto the nxdomain reply for an hour+ and never checks back with acme-dns till it's too late and the letsencrypt request has expired.
@apeschar commented on GitHub (Sep 13, 2023):
I believe that the last field in the SOA record should be set to a much lower value (eg,
1or60) to prevent NXDOMAIN responses from being cached for a long term. It's currently86400, which may lead to NXDOMAIN responses being cached for up to a day.https://github.com/joohoi/acme-dns/blob/master/dns.go#L65
@joohoi commented on GitHub (Sep 14, 2023):
Good point, 60sec should be sufficient.