Welcome to the ITFreeTraining video on DNS Time to Live, Aging and Scavenging. Hopefully
your DNS server will always return the correct information, however if it does not, understanding
how these setting work can help the administrator improve the accuracy of DNS records.
The first setting that I will look at is time to live. Time to live, otherwise known as
TTL, is the time a DNS record is allowed to be stored in cache before it is automatically
removed and a new query must be sent to a DNS server to retrieve the record again.
To consider what this means, consider this example. A client wants to obtain the IP address
for a DNS name. In order to do this, it will send a DNS query to a DNS server, in this
case the ISP’s DNS server. The ISP will then contact an Authority DNS server in order
to obtain the DNS record the client is asking for.
Once the DNS record is obtained, it will be stored in the cache for the ISP’s DNS. It
will then be passed onto the client and the client will store this record in its DNS cache.
The problem occurs if the DNS record were to change as the DNS record stored in cache
would now be incorrect. The client and the DNS server now both have
a DNS record that are incorrect and will keep using the wrong information. This is where
the time to live setting comes into play. The time to live setting allows the administrator
to determine how long a DNS record can be used before the DNS server and client will be forced
to requerry the DNS record rather than using the cached version.
By allowing the administrator the ability to configure this setting, this means the
time to live can be configured according to the administrator’s requirements. For example,
a very static host that rarely changes may be configured with a very high time to live.
The higher the time to live, the less queries the authority DNS server will receive, however
a high time to live setting does come at a price. If for any reason the DNS record were
to change, a high setting would mean the old DNS record would be used for a long period
of time. For mission critical systems like e-mail,
administrators will often choose a lower time to live setting. With a lower setting, this
means that if the e-mail server went down and the IP Address had to change for whatever
reason, the time taken for the clients to start using the new DNS record would be reduced.
In this case, it is better for the authority DNS server to receive more DNS queries for
the e-mail server then have it be un-contactable for an extended period of time because clients
are using an old IP address. You can see why setting the time to live value is an important
balance between responding to change and network traffic.
The next point that I want to look at is DNS Record Aging. This applies to dynamic DNS
records, that is DNS records that have been registered by the client on the DNS server.
It can also be configured on static DNS records but is not by default.
What essentially happens is that when a DNS record is created in DNS, a timestamp is added
to the DNS record. This timestamp records the date and time the DNS record was created.
As we will see later on in this video, this timestamp is used with Scavenging to remove
DNS records from DNS. The timestamp on a DNS record can be updated.
For example, when a computer first starts up it may attempt to update its DNS records
on the DNS server using dynamic update. When this occurs, the timestamp on the DNS server
may get updated. Yes you heard right, it may get updated. Let’s look at the reasons why
this may or may not happen. Imagine that you have a typical network with
100’s of computers and devices on it. Each day, each of these computers starts up and
attempts to update its host record using dynamic DNS on its local DNS server. This results
in 100’s of updates received each day by the DNS Server.
This may not seem like a lot, but when you consider that each of these changes needs
to be replicated to the other DNS servers on the network, you can start to see that
in large organization this can amount to a lot of network traffic. In most cases, the
client will have the same IP Address and host name so the only item that will be changing
is the timestamp and thus is a lot of replication traffic for the sake of keeping the timestamp
up to date. You could imagine that on large company networks spanning the global, updating
the time stamp constantly is over kill and does not give any operational advantage, it
only uses up bandwidth. So how does DNS server reduce the amount of replication involved
with keeping the time stamp up to date? DNS Server uses two settings called No-Refresh
Interval and Refresh Interval. These settings are often difficult for students to understand
without understanding what that are trying to achieve. Just remember that two settings
together are attempting to reduce DNS replication traffic and also ensure that a DNS record
is not removed too quickly in case it is still needed.
First of all I will look at the No-Refresh interval. By default this is configured for
7 days. In this time, the timestamp alone cannot be updated. This helps reduce the amount
of replication traffic, but there are also other changes that can happen to a DNS record.
These changes are allowed to be made during this period, it is only if the timestamp is
attempted to be changed by itself in this period that it is not allow. For example, changes
like the IP Address changing or for a service record or port changing are allowed.
The next setting is the Refresh Interval. This by default is configured to 7 days. In
this time any data in the DNS records can be updated including the time stamp. The DNS
records will not be removed in this time. This effectively gives the device that registered
the DNS record 7 days to update the DNS server and thus let the DNS server know that the
DNS record is still required. This essentially means, by default, it takes
14 days before a DNS record that is registered in DNS before it can be removed. You can see
that using a system like this gives a balance between replication traffic but also gives
the device time to reregister the DNS record before it is removed. This brings us to the
next topic, removing the DNS records. Scavenging is the process of removing outdated
DNS records. Scavenging looks at the time stamp of the DNS record in order to determine
if the DNS record should be removed. This will occur after the No-refresh Interval and
Refresh interval, which is 14 days by default. The important thing to remember with Scavenging
is that it is not configured by default. In order to configure Scavenging, a number of
settings need to be configured which I will look at in a moment. If these settings are
not configured correctly, Scavenging will not occur. Also for this reason, Scavenging
can appear to happen quite randomly. It is not uncommon for an administrator to be looking
at DNS and seeing DNS records that they believe should be scavenged and they are not automatically
removed, but later on suddenly disappear. The next point to remember is that if your
clients are not dynamically updating their DNS records, this includes resources records
used for Active Directory, these will be scavenged. Having all the resources records for your
Active Directory Domain Controllers suddenly being removed can have the effect of preventing
any user on the domain from being able to login. So if you enable scavenging, the two
points to remember are, be patient the records will be removed eventually and ensure there
is nothing preventing your clients, especially Domain Controllers, from registering DNS records.
I will now change to my Windows 8 computer to look at how to configure the DNS Scavenging
option using remote management tools. First of all I need to open the control panel
by opening charms, select settings and then selecting control panel. Once the control
panel is open I will type in “Admin” in the search dialog in order to locate Administrative
Tools. Once Administrative Tools is open, it is a
simple matter to find DNS and open it. The DNS admin tool will ask which DNS server you
want to connect to. In this case I want to connect to NYDC1.
Once the admin tool has opened, I will right click on NYDC1 and go down to the option Set
Aging/Scavenging for All Zones. I will not select this option as yet, because I want
to demonstrate that this setting is also found in the zones.
Before I look at configuring the scavenging setting for a zone, I will first expand down
through DNS until I get down to the single DNS record for WS1. If I right click on the
DNS record and select properties, you can see in here the properties for the DNS record,
but there are some properties that are missing. To access these properties, I will close out
of here, go to menu view and select the option advanced. Once this is done, when I open the
properties for the DNS record again notice at the bottom is the Time To Live value. For
this DNS record the time to live is set to 20 minutes. This means that a DNS server will
only be able to keep this DNS record in its cache for 20 minutes before it is forced to
contact an authoritative DNS server to obtain the DNS record again.
Above this notice there is a tick box, delete this record when it becomes stale. If this
tick box is ticked, when the DNS server is running its Scavenging process, this DNS record
will be removed if the record is old enough, by default 14 days. The point to remember
here is that if the tick box is not ticked, this record will not be able to be removed by
the scavenging process even if I have configured other options for scavenging. By default,
dynamically created DNS records will have this ticked and manually created DNS records
will not. Below this you can set the record time stamp.
This is what the scavenging process will look at to determine if the DNS record should be
removed. Assuming that all the DNS records that you
wanted scavenged have the “Delete this record when it becomes stale” option ticked, the
next step is to configure the option in the zone file. To do this, I will exit out of
this record and right click the ITFreeTraining.local zone and select properties.
Once the properties are open, this next step is to press the button aging. This will show
the settings that are used with Scavenging for this zone.
To enable scavenging, all you need to do is tick the option “Scavenge stale resource
records”. In order to determine the time period the DNS record is allow to exist before
it is removed, the next two options are used. The first option, no-refresh interval will
not allow the updates of only the timestamp to be updated during this period, in this
case 7 days. Any other changes in the DNS record can be updated. This setting is here
to help reduce replication. Without this setting, every time a computer started up and it updated
its DNS record, this change would need to be replicated.
The next setting is the refresh interval. This setting determines how long after the
no refresh interval the time stamp on the DNS record can be updated. So effectively,
by using these settings, updates of only the time stamp can only be performed between 7
and 14 days. If the DNS records are not updated in any way in the 14 day period, the next
time the scavenging process is run the DNS record will be removed assuming that the DNS
record has the option “Delete this record when it becomes stale” ticked.
In this case, I will untick “scavenge stale resource records” and thus not enable scavenging
to prove a point. I will now exit out of here, right click on the NYDC1 once again and this
time select the option “Set Aging/Scavenging for All Zones”, you would think by the wording
this would configure scavenging for all zones but this is not the case. As we will see in
a moment, this only sets the default for Active Directory integrated zones.
Notice that these are the same options that I had for the zone. If I tick “scavenge
stale resource records” and press o.k. I will be presented with a dialog message.
Notice that the dialog states that “Scavenge stale resource records enabled”. This would
tend to suggest that all zones are changed, however notice above this that this setting
only change the default setting for new Active Directory Integrated zones. This does not
affect existing zones and if you decide to create a non-Active Directory Primary zone
later on, this setting will also not apply to those zones.
If you want these settings to apply to existing Active Directory Integrated zones, you can
tick the tick box at the bottom “Apply these settings to the existing Active Directory-integrated
Zones.” In this case, I will not change the existing zones, however I will go back to
scavenging properties for the ITFreeTraining.local zone and tick the option “Scavenge stale
resource records”. Once ticked and the option applied, the DNS server will start removing
outdated records the next time a Scavenging process is run. You can wait for this to occur,
or if you want to manually start the process, right click the DNS server and select the
option Scavenge Stale Resource Records. The point to remember is if you select this
option, this only starts the process up that checks for DNS records that need to be removed.
If the zone is not configured for scavenging or the DNS record is not ticked to be deleted
when the DNS record becomes stale, then no DNS records will be removed.
There has been a lot covered in this video so I will go through a quick summary of the
major points. The first point is the during the No-Refresh interval the time stamp for
the record cannot be updated or refreshed by itself. If other information in the DNS
record has changed, for example if the IP address of the client were to change, the DNS
record can be updated. The refresh interval timestamp is when the
timestamp can be updated and does not require anything else to have changed.
It should be remembered that DNS records are only scavenged if the timestamp on the DNS
record has not changed and it outside the No-Refresh Interval plus Refresh Interval.
This by default is 14 days. Also the DNS record has the option ticked to delete if the record
is stale and, lastly, if the zone is enabled for scavenging.
If you find that the DNS records on your system have not been removed, check all these options
and be patient. Well I hope you have enjoyed this free video
from ITFreeTraining and found it informative. All our videos are free for this course and
others. Thanks for watching and see you next time.