3

I dig xkcd.com, and I get something like this back:

; <<>> DiG 9.9.5-3ubuntu0.1-Ubuntu <<>> xkcd.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52538
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 5

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;xkcd.com.          IN  A

;; ANSWER SECTION:
xkcd.com.       769 IN  A   107.6.106.82

;; AUTHORITY SECTION:
xkcd.com.       87784   IN  NS  dns3.p03.nsone.net.
xkcd.com.       87784   IN  NS  dns1.p03.nsone.net.
xkcd.com.       87784   IN  NS  dns2.p03.nsone.net.
xkcd.com.       87784   IN  NS  dns4.p03.nsone.net.

;; ADDITIONAL SECTION:
dns1.p03.nsone.net. 70809   IN  A   198.51.44.3
dns2.p03.nsone.net. 70809   IN  A   198.51.45.3
dns3.p03.nsone.net. 71406   IN  A   198.51.44.67
dns4.p03.nsone.net. 70809   IN  A   198.51.45.67

;; Query time: 222 msec
;; SERVER: 127.0.1.1#53(127.0.1.1)
;; WHEN: Wed Jan 21 22:16:42 HKT 2015
;; MSG SIZE  rcvd: 206

The 769 is the cached TTL value for xkcd.com. However, when I do repeat dig xkcd.com several times (within a few seconds of each other), I get a seemingly random TTL value everytime. Here's the sequence:

TRY | ANSWER | AUTHORITY | ADDITIONAL | WHEN
====================================================================
1   | 586    | 59577     | 44474      | Wed Jan 21 22:18:31 HKT 2015
2   | 587    | 14242     | 56745      | Wed Jan 21 22:18:32 HKT 2015
3   | 658    | 87673     | 70698      | Wed Jan 21 22:18:34 HKT 2015
4   | 1022   | 76200     | 51189      | Wed Jan 21 22:18:40 HKT 2015
5   | 1200   | 160954    | 44662      | Wed Jan 21 22:18:41 HKT 2015
6   | 574    | 59565     | 44462      | Wed Jan 21 22:18:43 HKT 2015
7   | 646    | 87661     | 70686      | Wed Jan 21 22:18:46 HKT 2015
8   | 1200   | 121364    | 55967      | Wed Jan 21 22:18:47 HKT 2015
9   | 1200   | 83292     | 54698      | Wed Jan 21 22:18:48 HKT 2015
10  | 1024   | 40540     | 43816      | Wed Jan 21 22:18:49 HKT 2015

Why do I get this seemingly random (within a range) values for TTL? I expect it to decrease gradually, since it is cached.

Andrew B
  • 31,858
  • 12
  • 90
  • 128
dayuloli
  • 1,223
  • 1
  • 10
  • 18

1 Answers1

7

Dig reports the time left until the TTL expires rather than the actual TTL value. If the number varies, it is most likely that you're querying different DNS servers (for example, round robin) which have the record cached for different amounts of time, and therefore have different expiry times.

If you run the same query against the same DNS server, you will see the TTL decrease by (roughly) the same number of seconds you waited between queries. See below:

ragnarok:~ cwatson$ dig a cwatson.org @192.168.50.11; sleep 2s; dig a cwatson.org @192.168.50.11

; <<>> DiG 9.8.3-P1 <<>> a cwatson.org @192.168.50.11
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39178
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;cwatson.org.           IN  A

;; ANSWER SECTION:
cwatson.org.        5847    IN  A   46.249.223.150

;; Query time: 43 msec
;; SERVER: 192.168.50.11#53(192.168.50.11)
;; WHEN: Wed Jan 21 14:51:08 2015
;; MSG SIZE  rcvd: 45


; <<>> DiG 9.8.3-P1 <<>> a cwatson.org @192.168.50.11
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24943
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;cwatson.org.           IN  A

;; ANSWER SECTION:
cwatson.org.        5845    IN  A   46.249.223.150

;; Query time: 45 msec
;; SERVER: 192.168.50.11#53(192.168.50.11)
;; WHEN: Wed Jan 21 14:51:10 2015
;; MSG SIZE  rcvd: 45

So, for your full example, you have 769 seconds until the A record expires, which will force a re-lookup from your upstream DNS server.

See the answer here for more detail.

Community
  • 1
Craig Watson
  • 9,370
  • 3
  • 30
  • 46
  • 1
    If so, the `TTL` value should decrease gradually, but it does not. (I appreciate your time in answering me and I didn't downvote you) – dayuloli Jan 21 '15 at 14:40
  • Not to be pedantic, but doesn't Time To Live mean Time until expiration? – NickW Jan 21 '15 at 14:40
  • @NickW it does, but there's some ambiguity between "the time until the record expires" and "the TTL of the record". The former is what dig reports. – Craig Watson Jan 21 '15 at 14:42
  • 2
    @dayuloli - I've just edited my answer with clarification. – Craig Watson Jan 21 '15 at 14:43
  • @CraigWatson Thank you for your time. I'll look more into 'round robin' and this 'load balancing' thingymajiggy – dayuloli Jan 21 '15 at 14:44