21 Apr
2023
21 Apr
'23
1:14 p.m.
Hello,
If you do not make use of BitFolk's secondary DNS service then you
can safely skip this email.
Over the last few days we've upgraded the servers used for our
secondary DNS service and also switched software from PowerDNS to
BIND. On the whole nothing changes, but there is one thing I would
like to draw your attention to.
BIND actually pays attention to the expire timers that you set
in your SOA records whereas PowerDNS does not.
An SOA record looks like this:
$ dig +multi +noall +answer -t soa bitfolk.com
bitfolk.com. 86383 IN SOA a.authns.bitfolk.co.uk. hostmaster.bitfolk.com. (
2023042101 ; serial
14400 ; refresh (4 hours)
7200 ; retry (2 hours)
1209600 ; expire (2 weeks)
43200 ; minimum (12 hours)
)
The "expire" timer tells authoritative DNS servers how long the
records they hold are valid for, if they have not been able to
contact the primary nameservers. In the above example, should the
primary nameserver be unreachable, any secondary nameservers that
are still responding will serve the zone content for a further two
weeks. After that time they will respond with SERVFAIL. Compliant
DNS client behaviour is to retry any other servers when that
happens.
PowerDNS does not implement these "expire" semantics and always
answers queries.
In watching logs carefully over the last few days I have seen that
some of you have extremely short expire timers. I'm not sure whether
you intend for that to be the case. For example, there are many
zones currently on BitFolk's servers with an expire time of 300
seconds. That means that you are indicating that the entire zone
should not be served 5 minutes¹ after your primary server stops
responding. It doesn't seem likely to me that you really want all
authoritative servers for your domain to stop working 5 minutes into
any sort of outage.
Since the secondary servers will now really believe you on this, I
urge you to review your expire timers. If in doubt please put your
domain name into this:
https://zonemaster.net/en/run-test
and it'll advise you if any of those timers seem wrong.
Cheers,
Andy
¹ Different DNS server implementations actually behave slightly
differently here. As mentioned, PowerDNS doesn't handle expire
timers at all. BIND has a minimum of 300 seconds, or the
refresh+retry timers, whichever is larger. So in fact the shortest
expire behaviour I can see at the moment is 600 seconds (10
minutes). Which still seems unusually short.
See:
https://jpmens.net/2022/01/14/fun-with-the-dns-soa-expire-field/
for more info about how different implementations treat the expire
timer.
--
https://bitfolk.com/ -- No-nonsense VPS hosting
21 Apr
21 Apr
3:50 p.m.
On Fri, 2023-04-21 at 13:14 +0000, Andy Smith via BitFolk Users wrote:
Hello,
If you do not make use of BitFolk's secondary DNS service then you
can safely skip this email.
Over the last few days we've upgraded the servers used for our
secondary DNS service and also switched software from PowerDNS to
BIND. On the whole nothing changes, but there is one thing I would
like to draw your attention to.
May I ask why? I have considered switching from BIND to PowerDNS many
times over the past few years (but never did).
Conrad
4:15 p.m.
Hi Conrad,
On Fri, Apr 21, 2023 at 04:50:54PM +0100, Conrad Wood via BitFolk Users wrote:
On Fri, 2023-04-21 at 13:14 +0000, Andy Smith via
BitFolk Users wrote:
Mainly that I'm a bit more comfortable with BIND and I realised that
unlike in ~2007 when I last evaluated this, BIND does now have the
ability to dynamically learn which zones to be secondary for
("catalog zones"), which was the only "advanced" feature of PowerDNS
that we were using.
The configuration of PowerDNS that we were using involved receiving
notifies and doing axfr just like BIND would and there was a known
deficiency there.
When a PowerDNS "superslave" receives a notify it does an SOA check
to get the serial number of the zone on the primary to compare with
its own. When acting as a DNS client PowerDNS does not support TCP,
so if the answer is truncated it treats it as no answer and refuses
to do an AXFR.
More details here:
https://strugglers.net/~andy/blog/2022/11/18/powerdns-truncated-soa-respons…
Also, I have been investigating some very occasional incidents where
a notify would get sent by a.authns but then one or more of the
PowerDNS secondary servers would simply log "timeout" for that
particular zone and not do the AXFR. They would then wait until
their refresh timer ran out to do a check and the needed AXFR.
I'm not 100% convinced that PowerDNS is the best choice for
conventional DNS replication by AXFR so I decided to investigate
BIND in that role. If I wanted an SQL database and the replication
within that then I'd definitely still stick with PowerDNS.
It is also possible that just upgrading PowerDNS would have helped
but it seemed like less work to deploy BIND as I already was
elsewhere.
Cheers,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
Over the last few days we've upgraded the
servers used for our
secondary DNS service and also switched software from PowerDNS to
BIND.
May I ask why? I have considered switching from BIND to PowerDNS many
times over the past few years (but never did).
5:09 p.m.
On Fri, 2023-04-21 at 16:15 +0000, Andy Smith via BitFolk Users wrote:
Hi Conrad,
On Fri, Apr 21, 2023 at 04:50:54PM +0100, Conrad Wood via BitFolk
Users wrote:
Thank you for the comprehensive write up!
Conrad
On Fri, 2023-04-21 at 13:14 +0000, Andy Smith via
BitFolk Users
wrote:
Mainly that I'm a bit more comfortable with BIND and I realised that
unlike in ~2007 when I last evaluated this, BIND does now have the
ability to dynamically learn which zones to be secondary for
("catalog zones"), which was the only "advanced" feature of
PowerDNS
that we were using.
The configuration of PowerDNS that we were using involved receiving
notifies and doing axfr just like BIND would and there was a known
deficiency there.
When a PowerDNS "superslave" receives a notify it does an SOA check
to get the serial number of the zone on the primary to compare with
its own. When acting as a DNS client PowerDNS does not support TCP,
so if the answer is truncated it treats it as no answer and refuses
to do an AXFR.
More details here:
https://strugglers.net/~andy/blog/2022/11/18/powerdns-truncated-soa-respons…
Also, I have been investigating some very occasional incidents where
a notify would get sent by a.authns but then one or more of the
PowerDNS secondary servers would simply log "timeout" for that
particular zone and not do the AXFR. They would then wait until
their refresh timer ran out to do a check and the needed AXFR.
I'm not 100% convinced that PowerDNS is the best choice for
conventional DNS replication by AXFR so I decided to investigate
BIND in that role. If I wanted an SQL database and the replication
within that then I'd definitely still stick with PowerDNS.
It is also possible that just upgrading PowerDNS would have helped
but it seemed like less work to deploy BIND as I already was
elsewhere.
Cheers,
Andy
Over the last few days we've upgraded the
servers used for our
secondary DNS service and also switched software from PowerDNS to
BIND.
May I ask why? I have considered switching from BIND to PowerDNS
many
times over the past few years (but never did).
390
days inactive
390
days old
3 comments
2 participants
participants (2)
-
Andy Smith -
Conrad Wood