[GH-ISSUE #2574] Recursor: Name server pool cache does not check TTL #1019

New issue

Closed

opened 2026-03-16 01:18:00 +03:00 by kerem · 1 comment

kerem commented

2026-03-16 01:18:00 +03:00

Owner

Originally created by @divergentdave on GitHub (Nov 14, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2574

Name server pools are stored in a LruCache in the recursor. Other than eviction by the LRU policy, there's no mechanism to remove a connection pool if the relevant NS/A/AAAA records change. While such changes are rare, this could create troubleshooting headaches.

This is mentioned by the following TODOs:
github.com/hickory-dns/hickory-dns@009c665caa/crates/recursor/src/recursor_dns_handle.rs (L403)
github.com/hickory-dns/hickory-dns@009c665caa/crates/recursor/src/recursor_dns_handle.rs (L461)
github.com/hickory-dns/hickory-dns@009c665caa/crates/recursor/src/recursor_dns_handle.rs (L580)

The simple solution would be to store the minimum TTL from the referral records, and rebuild a new pool once that time has elapsed. If the TTL is short, this may introduce unnecessary connection churn. This could be addressed by resolving nameservers again upon TTL expiry, and only discarding the existing pool if the list of IPs has changed, but that would require more invasive changes to the pool-building logic.

Originally created by @divergentdave on GitHub (Nov 14, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2574 Name server pools are stored in a `LruCache` in the recursor. Other than eviction by the LRU policy, there's no mechanism to remove a connection pool if the relevant NS/A/AAAA records change. While such changes are rare, this could create troubleshooting headaches. This is mentioned by the following TODOs: https://github.com/hickory-dns/hickory-dns/blob/009c665caaf46c144c503366857b5dfd0231b6c3/crates/recursor/src/recursor_dns_handle.rs#L403 https://github.com/hickory-dns/hickory-dns/blob/009c665caaf46c144c503366857b5dfd0231b6c3/crates/recursor/src/recursor_dns_handle.rs#L461 https://github.com/hickory-dns/hickory-dns/blob/009c665caaf46c144c503366857b5dfd0231b6c3/crates/recursor/src/recursor_dns_handle.rs#L580 The simple solution would be to store the minimum TTL from the referral records, and rebuild a new pool once that time has elapsed. If the TTL is short, this may introduce unnecessary connection churn. This could be addressed by resolving nameservers again upon TTL expiry, and only discarding the existing pool if the list of IPs has changed, but that would require more invasive changes to the pool-building logic.