[rbldnsd] TTLs and negative caching

[Michael Tokarev]

Jeff Chan wrote:
> We run SURBL which has RBLs containing spam URI domains.
> They are used to block spam based on URI domains contained
> in message bodies.
> 
> Currently some of our zone files have fairly long TTLs
> of several hours.  This appears to be causing new entries
> to take several hours to become active.

Hmm....  That does not seem to be right.  What's your
zone and any test url/domain, for me to check?

> 1.  Does that sound right?  In other words does TTL apply
> to negative caching or only to positive caching (or to both).
> By observing the behavior of an rbldnsd installation, TTL
> does seem to affect negative caching.

According to DNS specifications, negative TTL is taken from
the SOA record's minttl field (the last number in the $SOA
line).  So no, the TTL (either -t option or $TTL value) does
not affect negative TTL.

> 2.  Can we expect a lot more DNS traffic if we lower our
> TTLs to say 10 minutes?

In a usage like this (spammer's url/domain db), I don't expect
any significant increase of traffic after lowering *positive*
TTL, because positive hit ratio should be rather low anyway.
But playing with negative TTL should make much more difference.
IMHO ofcourse.

/mjt