Internet2 Network Security SIG

[David Farmer <>]

Severing stale DNS entries is by no means ideal.  However, if you can't refresh entries, serving stale info and having the user get a can't reach the server is better option than not answering or basically saying their isn't answer. At least in my opinion.  Because today when partitioned from the Internet a recursive DNS server essentially implodes after about 5 to 10 minutes, because of the back log of attempts to refresh info that the TTL has expired, giving up and serving stale info is a better option.

So for a recursive resolver, I think serving stale info is a better failure mode in general.

That's my 2 cents.

  

On Thu, Nov 2, 2017 at 8:44 PM, Bill Owens <> wrote:

It sounds as though this would solve many problems in your isolated campus scenario, but I wonder about the side effects on providers who load balance by returning different DNS results. It’s not uncommon to see 60-second TTLs in records from cloud providers, sometimes even shorter. I think it is unlikely that the server behind whatever A record BIND decided to stick with would simply go away, but it is possible that server would be overwhelmed by the continuous load from your campus. It might be worth a discussion with your critical cloud providers, if they’re willing to discuss that ‘secret sauce’.

Bill.

On Nov 2, 2017, at 11:00 AM, Steven Wallace <> wrote:

It’s going to get better. BIND 9.12 (currently in beta, GA due out end of year?) supports “serve stale” (see: https://tools.ietf.org/html/draft-tale-dnsop-serve-stale-02). Serving Stale Data to Improve DNS Resiliency - does what you’d expect. If the resolver can’t update a cached entry, it responsed with the its current cached entry. BTW, this would have mitigated the October Dyn outage, which left many in the community without access to Box, PayPal, etc., despite the fact that we had working network paths to these service providers.

--

===============================================
David Farmer              
Networking & Telecommunication Services
Office of Information Technology
University of Minnesota  
2218 University Ave SE        Phone: 612-626-0815
Minneapolis, MN 55414-3029   Cell: 612-812-9952
===============================================