mirror of
https://github.com/tailscale/tailscale.git
synced 2026-07-29 16:56:32 -04:00
0bbe6394de
The MagicDNS resolver answered NXDOMAIN and no-data queries with no SOA record in the authority section. RFC 2308 says such responses should not be cached, but some resolvers cache them anyway on their own schedule: macOS's mDNSResponder seems to cache them for a really long time, so a name queried shortly before a node was renamed to it didn't start resolving until something flushed the cache, such as toggling Tailscale off and on. Attach the zone's SOA record to negative responses for domains we're authoritative for, advertising a 10 second negative-caching TTL. The SOA serial is the response time in unix seconds; nothing consumes it (no secondaries, no zone transfers), but it's at least monotonic. Also lower the TTL of positive answers from 600 seconds to 5. The source of truth is local and in-memory, so re-queries are nearly free, while anything cached downstream delays clients noticing node renames for the full TTL. Updates tailscale/corp#45631 Change-Id: Ifb73874c8724f7d95ad7950dcb481f009acab9a4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>