Problems with bind9 caching too long

[Sam Hayes Merritt, III]

> On Fri, Mar 11, 2005 at 07:37:56PM -0500, Kevin Darcy wrote:
>> No, that's not a BIND bug. You've left the old version of the zone
>> running on ns1.pbi.net and ns2.pbi.net, and they'll keep on giving out
>> the stale NS records in response to queries. Other caching nameservers
>> such as aludra.usc.edu which had the NS records cached from prior to the
>> switchover will keep on using those nameservers to resolve nakos.net
>> names, and therefore keep seeing regurgitations of the stale NS records,
>> and the cycle will repeat until those caching nameservers are restarted
>> or those particular records in their caches expire or are purged out, or
>> until the pbi.net nameservers stop answering with stale NS records for
>> the zone (i.e. the zone is removed from them or is replaced by a more
>> up-to-date version).

> First, the stale record is from the .net name servers (which are the root
> nameservers), that record that delegates nakos.net to ns1.pbi.net. has expired
> and should be refreshed from where it came from.

You are partially correct. Yes, the .net name servers delegated nakos.net 
to ns1/ns2.pbi.net. The USC nameservers cached that.

> ns1.pbi.net is only authoritative for nakos.net by delegation from the .net
> servers, and this should be honored.

It is, for any new lookups.

> Secondly, every other server on the net I can find has the new addresses,
> leading me to believe there is some sort of configuration or something I've
> missed - why is it only USC's servers continue to get the old data?

Noone else had it cached, or may be running different software.

The way bind works, as he explained, was it found the authoritative 
nameservers. It continues to use those, as long as they provide an 
authoritative answer until the sun don't shine no more. It doesn't go 
back to the root again to ask for the authoritative unless it no longer 
has the info cached. To get that to stop, you would do a rndc flushname 
nakos.net for each server. Or restart Bind.

Although the correct way would be for the owner of nakos.net to actually 
finish moving their domain. They got halfway their, now they need to 
complete the job and ask pbi to remove it from their nameservers and then 
make sure they actually remove it. Without that step, theres probably 
other nameserver somewhere that will have the old authoritative cached.


sam