Using DNS records beyond the owner-published TTL is risky business. You can’t even know if the same legal entity is providing the content or services previously published at that address/endpoint, and this uncertainty raises security and/or liability concerns.
- Kevin From: Ron [mailto:ron.a...@gmail.com] Sent: Thursday, March 17, 2016 11:46 AM To: Darcy Kevin (FCA) Cc: bind-users@lists.isc.org Subject: Re: Can bind be configured to not drop RR's from the cache when the upstream DNS server is unresponsive I did not mean forwarders, but I had a case where the authoritative name servers for a domain were down for an extended period of time, exceeding the ttl for their records. I was curious if I could tell my DNS servers to serve these records for longer than the registered ttl. And I wanted to automate that. But I'm afraid that's not gonna fly. Ron On Thu, Mar 17, 2016 at 4:27 PM, Darcy Kevin (FCA) <kevin.da...@fcagroup.com<mailto:kevin.da...@fcagroup.com>> wrote: By “upstream” I assume you’re talking about forwarders. If your forwarders are flakey, have you ever considered simply *not*forwarding*? That would seem to be a better, structural solution to your problem, than holding DNS data beyond its cache-expiration time (a really BAD idea). - Kevin [FCA_Pantone_email] ---------------------------------------------------------------------- Kevin Darcy NAFTA Information Security Projects FCA US LLC 1075 W Entrance Dr, Auburn Hills, MI 48326 USA Telephone: +1 (248) 838-6601<tel:%2B1%20%28248%29%20838-6601> Mobile: +1 (810) 397-0103<tel:%2B1%20%28810%29%20397-0103> Email: kevin.da...@fcagroup.com<mailto:kevin.da...@fcagroup.com> From: bind-users-boun...@lists.isc.org<mailto:bind-users-boun...@lists.isc.org> [mailto:bind-users-boun...@lists.isc.org<mailto:bind-users-boun...@lists.isc.org>] On Behalf Of Ron Sent: Thursday, March 17, 2016 7:37 AM To: bind-users@lists.isc.org<mailto:bind-users@lists.isc.org> Subject: Can bind be configured to not drop RR's from the cache when the upstream DNS server is unresponsive Hi, subject says all. Read manpages, could not find this in the FAQ's. Hope this is possible. If not does anyone know of other name servers that offer this option? Thanks, Ron Arts _______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org<mailto:bind-users@lists.isc.org> https://lists.isc.org/mailman/listinfo/bind-users
_______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users