Negative DNS Caching

I have a Win2008R2 AD environment used to auth both Windows (20%) and OSX (80%). I was asked about Negative DNS Caching in my AD environment and found that the default is 1-hour.
My question is ... why is the default so high? Why not decrease it to 1-minute like google corp does.
➔ dig SOA corp.google.com +multiline
; <<>> DiG 9.8.3-P1 <<>> SOA corp.google.com +multiline
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39371
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;corp.google.com. IN SOA
;; ANSWER SECTION:
corp.google.com. 86400 IN SOA ns1.google.com. dns-admin.google.com. (
2014020700 ; serial
21600 ; refresh (6 hours)
3600 ; retry (1 hour)
1038800 ; expire (1 week 5 days 33 minutes 20 seconds)
60 ; minimum (1 minute)
;; Query time: 46 msec
;; SERVER: 10.10.10.5#53(10.10.10.5)
;; WHEN: Fri Mar 6 00:17:39 2015
;; MSG SIZE rcvd: 83
For additional info, see https://tools.ietf.org/html/rfc2308

Per RFC 2308 http://www.rfc-editor.org/rfc/rfc2308.txt, section 5, the negative cache time depends on the zone. It is the lesser of two values, either the TTL for the SOA record or the "minimum
TTL" for the entire zone that is defined in the SOA.
"When the authoritative server creates this record its TTL is taken from the minimum of the SOA.MINIMUM field and SOA's TTL."
Windows Server also has a global MaxNegativeTTL setting. Use Get- and Set-DnsServerCache to view or configure it. The default is 15 minutes.
PS C:\> Get-DnsServerCache
MaxTTL                           : 1.00:00:00
MaxNegativeTTL                   : 00:15:00
MaxKBSize                        : 0
EnablePollutionProtection        : True
LockingPercent                   : 100
StoreEmptyAuthenticationResponse : True
-Greg

Similar Messages

Java DNS Caching

I have my Java DNS cache expiring every five minutes by setting it up in java.security. My question is - what happens when the DNS server is unreachable, ie. down ? Does Java retain what it already had in the event that it cannot reach a DNS server to update from, or does the domain that was being accessed become unavailable ?

Thank you for your response. At least now I know it isn't something that I misconfigured. It is interesting that if I add this line to obj.conf, the statistics function appears to work, even though according to the admin interface DNS caching is disabled: (I got this from the help system.)
Init cache-size="1024" expire="1200" fn="ip-dns-cache-init"
The original entry put there by the admin interface is:
Init cache-size="1024" expire="1200" negative-dns-cache="yes" fn="host-dns-cache-init"
I do not have a Sun support contract. Is there a procedure to report this bug, or have you already done that?

Clear DNS cache

How can I clear the DNS cache?
When I configure my webserver and change the records, I have to wait the time configured in the ttl of the specific record. I know, that I can change the ttl to a lower value, but the default value is 3 hours, so i have to wait until the time's up.
I checked the DNS records with dig (from dnsutils). dig also shows the remaining seconds until the next refresh (dns server request). And here's my question: How can I refresh it manually? (tried a lot from the internet, but nothing helped)
Thank you guys!
Last edited by gummiflummi (2014-12-16 20:41:53)

brebs wrote:Woah right there. Why do you need to *change* the records? Shouldn't happen often.
Other than the answer stated (to test DNS settings), you might want to change records for a (self-hosted) DynDNS service. If you want a device to updated its DNS entries while being connected to a shaky cellular network, those changes might occur frequently with changing IPs.
To the original poster: You should always set the TTL to a reasonable setting. If you didn't change the record for the last two years, then maybe a TTL of several hours (or even a day) might be OK. If you want to be able to react more quickly to emergency situations, set it lower. For a DynDNS service, TTLs below a minute might be appropriate.
If you want to test your DNS Server, you can always query it directly (bypassing your ISP's DNS servers) with a command like this (where 1.2.3.4 is the IP of your nameserver):
dig @1.2.3.4 your.entry.example.com
This will usually show you the new settings right after changing.

Possible DNS caching problem

I just upgraded to Lion. I am a web deveoper and I just changed the DNS settings for a new website. While everyone else in my office is seeing the new wesite at the domain, I am stuck seeing the old. I have tried the DNS cache flushing techniques below (in addition to restarting, clearing cache, etc), but none have helped:
sudo killall -HUP mDNSResponder
dscachutil -flushcache
In the terminal 'host domain.com' still points to the old server too.
Seems like OSX is holding on to the old DNS settings. Any ideas?

Select  ▹ System Preferences ▹ Network ▹ Advanced ▹ Proxies. If any boxes are checked, uncheck them, apply your changes, and try again. You must apply the changes before they take effect.

How to Flush DNS Cache in Mavericks 10.9.3

So I have seen references to the following when searching for a cmd to flush DNS
sudo killall -HUP mDNSResponder and sudo dscacheutil -flushcache
Which one is proper for Mavericks 10.9.3?

Mountain Lion, but should be applicable to Mavericks.
DNS cache - Reset

Flushing the DNS cache

I'm having trouble with a Web site when I access it on my home computer, yet this same site looks fine on my Mini at work. One section of the index page generates a "can't find server" error, and the site's own logo won't display properly. It is a free hosting site. Sometimes I can upload files to it, other times I get a can't-find-server error when I try.
In answer to my query about this (to which I helpfully attached a screenshot of the incompletely loaded index page and its error messages), the host is telling me that I should "flush my DNS cache," which they say involves going into Terminal and giving the command "ookupd -flushcache" [sic]. (I've already surfed this briefly and the first result confirmed my suspicion that this doofus hasn't mastered copy-and-paste technique and the command actually should be "lookupd- flushcache".)
It's not just that their site doesn't load fully, though. They have some stuff on one of their pages that they encourage users to hotlink on personal Web sites, and I have done that with one of their banners. The banner, which was fine for months, now appears on my page as a broken icon, too, although it, like the site's home page, loads fine on my computer at work.
My first question is, is there any harm in flushing the DNS cache? The OS Daily page where I think they copied this advice from makes it sound like this is something only a Web server would need. If I do it on my home machine, could it cause problems? Could it disable my Internet connectivity?
Second, less urgent question, more for the netgeeks out there: Do you think this is a likely solution to my problem? Especially considering that the problem involves not only their site but an element on an external site linking back to them? I hate to play the sucker for some low-level geek whose main mission is to deflect my query.
Thanks
Kathi

Kathi--
Like BDAqua says, there's nothing to worry about flushing the DNS cache. It's true that most people probably don't need to do it very often, but it's something easy and harmless to try, and it might well fix problems like yours.
One handy feature of Safari, even if you don't use it for anything else, is the "Activity" window. Open it from the "View" menu, and watch as your page loads. You can see exactly which components on the page are loading, which aren't and where they should be coming from. If you double-click an element in that list, Safari will try to open it in a new window. That is sometimes enough to give a clue as to why something isn't working.
You can use Safari's activity list along with the Network Utility from your Utilities folder to try to figure out why you're not getting the page elements. Suppose a graphic is listed as coming from http://www.server1.com/images/logo.jpg, but it's not loading.
First thing I would try in the Network Utility is to see if it will respond to pings. From that example, enter "www.server1.com" on the "Ping" page of the Network Utility and see if it answers back.
To find out if it's a DNS problem, you can use Safari's list to get the addresses of the problem elements, then see if the IP addresses match up on your computer at home to the one at work. If they don't, then it could be stale DNS.
You can use the Network Utility for DNS lookups, but I think they're hard to read, and, since you're already thinking about using the Terminal to flush the DNS cache, you can use nslookup. It's really simple:
<pre class="command">nslookup www.apple.com</pre>
Will give you something like this (the first two lines will likely be different):
Server: 208.67.222.222
Address: 208.67.222.222#53
Non-authoritative answer:
www.apple.com canonical name = www.apple.com.akadns.net.
Name: www.apple.com.akadns.net
Address: 17.251.200.32
If the addresses don't match, or you get a message that it can't find anything for your server, then you know it's a DNS problem. Perhaps they've changed some addresses and your home ISP's DNS servers themselves aren't updating.
You can even use nslookup to see what different DNS servers say about an address. Just add the IP address of a DNS server after the address you want to look up:
<pre class="command">nslookup www.apple.com 208.67.220.220</pre>
Just do a search on the 'net for free DNS servers, and you'll find a bunch to choose from.
charlie

How can I clear the DNS cache?

I haven't been able to connect to my local Library since January. When I key in the URL, it starts the access routine and then after about 20 minutes, I have to kill it because nothing happens. I contacted the IT folks at the library and was told that they had made a few changes around the time my problem began so maybe the DNS cache was still pointing at the old info. He recommended that I enter TERMINAL mode and try to clear the DNS cache, using "sudo dscacheutil -flushcache" command. . I attempted this several times, even changing my applid password, and kept getting invalid responses.

I did try that and after a few trys it finally worked. It took quite awhile for the window for the library to finally come up, but it did and I am now able to get in and out with no problems with my library access. Now when I call up my bank, parts of it don't come up and it kicks me out. Now, I'll have to search for what fixes that - as it has happened before, so I know it's fixable. Thanks for you help though.

Export DNS cache

After searching around, I've found a ton of posts about clearing DNS Cache, but what I'm actually looking for is a way to export the DNS cache out of bind to some sort of text file. Basically, I'm hoping to build a static dns cache lookup file to use with AWStats, and wanted to see if it was worthwhile using entries from the several DNS servers we having running.

Hi Alex
rndc dumpdb should do.
Regards
--greg

Flush the DNS cache

How do i flush the DNS cache on an iPhone?

TrYaN73 wrote:
How do i flush the DNS cache on an iPhone?
There's no specific way to do that exact thing in iOS. However, resetting network settings will help resolve a lot of network-related issues for both Wi-Fi and cellular connections.
Reset network settings by tapping Settings > General > Reset > Reset Network Settings.

DNS Caching

I am having some trouble understanding the operation and configuration of DNS caching on a CE.
Does the listener command intercept the CE's DNS requests that would normally go to the nameserver configured with the "ip name-server" command(s) and send them to the name or address used in the listener command?
What does this mean: " The DNS server must know the DNS name of the host on which it is being enabled and map it to an IP address within its own cache."? I can't tell if the DNS server referenced is the CE.
Also, is it more common to limit the cache size on the smaller end of the scale or the upper end?
Thanks.

"dns listen" command has to be configured with the name and ip address of your dns server. You can use the "dns pin" command to do this.
http://www.cisco.com/univercd/cc/td/doc/product/webscale/uce/acns50/cref50/14623ref.htm#2408858
DNS-caching on the CE is not a "caching dns server". It is only for the CE to use itself - and not to point the PC's "dns server" at. DNS is only needed in Proxy mode.

Negative result caching, aggregation threads

I have two questions:
1. Do any of the coherence caches do "negative" result caching? An example to explain what I mean:
I have a near cache in front of a partitioned cache which is backed by a database. I do a get which looks in the near cache, partitioned cache, and DB and doesn't find the value. If I then do another get for the same key will coherence go all the way to the DB again to look for it? Does containsKey work the same way?
2. Is it to increase the number of threads used for aggregation on a single coherence node? I have a machine with lots of cores, and a parallel aggregator that uses a fair bit of CPU. I would like Coherence to run multiple instances of the aggregator in parallel without me having to start lots of processes.

Hi Cormac,
if I understand correctly, what you mean is: in case there are idle threads in the thread-pool, you want them to be utilized by multiple threads working on the same aggregation within the same storage node, dividing the partitions among them.
Splitting a single partition between multiple aggregators would contradicts answers to questions regarding the behaviour of aggregators and possibly also break documented API, and anyway would render parallel aggregations unusable by weakening guarantees about aggregating entries for which a partition affinity is defined together with each other.
The above things are not possible in the current version, and I am not sure if it is possible in upcoming versions, but some changes in the just released developer pre-release version make this less costly than it was up to 3.4.2.
One of the problems is that AbstractAggregator is stateful in the sense that it wants you to maintain a temporary result in an attribute of the aggregator, therefore
- either your code would have to be thread-safe (which requirement is not documented and therefore introducing it would possibly break existing code out there). This would possibly also mean an increased cost in context switching due to synchronizing your changes to those attributes on multiple threads.
- or Coherence would have to instantiate multiple instances of your aggregator within the same storage node which comes with a somewhat increased memory footprint. Otherwise this would be doable.
On the other hand, you should remember that just because a thread is idle at a moment, it does not mean that there won't be many more requests coming in very soon afterwards which would be unnecessarily delayed by the parallel aggregator which consumes too many threads.
Best regards,
Robert

HT5343 Resetting the DNS cache does not seem to work on OS X 10.8, what does really work?

Resetting the DNS cache does not seem to work on OS X 10.8, what does really work?
Desired activity: access a site that used to not have a SSL connection through the new https:// root domain. I can accomplish the task over a machine running Windows 7 or XP but flushing the dns of my mac does not affect the outcome — I am still redirected to the hosting provider's website whenever I tried to access the domain with a https:// prefix rather than http://
I tried sudo killall -HUP mDNSResponder and it's older alternative but no luck.

In the terminal:
dscacheutil -flushcache
and to get a very detailed report on the state of your DNS cache in /var/logs/system.log:
sudo killall -INFO mDNSResponder

External DNS cache slow to update?

Hello.
Is there something in OS X 10.5 Server (which all machines use for their DNS server) that caches external DNS requests? I often find, within our network, external DNS cache is slow to be updated.
For example, right now, I just moved servers for a project I'm working on (well, I moved it 12 hours ago) and updated the DNS/zone file for it. When I'm outside our network, tracecroutes of the domain point to the new server. But, when I'm within the network, traceroutes still point to the old server.
The reason I think this has something to do with OS X 10.5 Server is, on the machine I'm sitting at right now, when DNS is set to the IP of the OS X 10.5 Server, external DNS is old (i.e., the traceroute on the domain I've moved still points to the old server). But, if I change the DNS to OpenDNS or Google DNS, the DNS information is new (i.e., the traceroute on the domains I've moved points to the new server).
Now, on the OS X 10.5 Server, I have "Forwarder IP Addresses" set to OpenDNS server. So, should DNS requests, via the OS X 10.5 Server, not make their way via OpenDNS servers? And if so, why is it that, when going through OS X 10.5 Server, I'm still pulling old DNS information?
I've:
- flushed the cache in OS X 10.5 Server (via dscacheutil -flushcache)
- flushed the cache on the 10.8 client machine (via sudo killall -HUP mDNSResponder)
- restarted the machines
Does anyone know what's going on here?
Thanks,
Kristin.

Hi
If it's any consolation both sites mentioned have always been slow to load for me. Regardless of Service Bandwidth, external/internal DNS, Browser, Platform or Location.
Occasionally and for no apparent reason they do load as quickly as other sites. Only to return to their usual 'performance' after a short time. There are other sites that perform the same for me which I can't think of at the moment.
Tony

How do I flush my DNS cache

My internet lookup is slow. I have read that I can fix this by using either openDNS or googleDNS servers. How Do I flush my DNS cache after switching DNS servers?

Restart the computer.

Where Is My DNS Cache And How Do I Clear It?

I'm using Timbuktu to reach my desktop iMac remotely. I subscribe to DYNDNS to detect IP changes. Recently, after a blackout, I could not reach the iMac remotely via DYNDNS. I WAS able to use the new IP (which I had someone look up for me) and Timbuktu connected just fine.
After contacting DYNDNS, they told me to clear my DNS cache, as that was probably the reason why their detecting system could not see the new IP.
My head is spinning. Can some kindly tell me where the DNS cache is on my iMac 10.4.11 and how to clear it? (For idiots, please).
Many thanks
---Gary

Yes, it's clear. Thanks.
I'm just too nervous to try this until my Mac Guru is sitting here. I can't unscramble anything I screw up...and that's a pretty good possibility based on past events.
Again, thanks
Gary

Negative DNS Caching

Similar Messages

Maybe you are looking for