Cloudflare caching far longer than DNS record timeout

1.1.1.1 - the Cloudflare resolver - is caching DNS records excessively. I have a record that expires in 30 seconds (cdn.m6securities.com). When the health check fails, the resolver fails over to the next available zone. This works fine with ISP resolvers, and 8.8.8.8, however Cloudflare seems to be caching records far longer. This really shouldn’t be happening. So far Google’s DNS has come and gone (over an hour ago), while Cloudflare is still retaining the address that should have expired 59 minutes, 30 seconds ago

https://1.1.1.1/help#eyJpc0NmIjoiWWVzIiwiaXNEb3QiOiJObyIsImlzRG9oIjoiTm8iLCJyZXNvbHZlcklwLTEuMS4xLjEiOiJZZXMiLCJyZXNvbHZlcklwLTEuMC4wLjEiOiJZZXMiLCJyZXNvbHZlcklwLTI2MDY6NDcwMDo0NzAwOjoxMTExIjoiTm8iLCJyZXNvbHZlcklwLTI2MDY6NDcwMDo0NzAwOjoxMDAxIjoiTm8iLCJkYXRhY2VudGVyTG9jYXRpb24iOiJBS0wiLCJpc1dhcnAiOiJObyIsImlzcE5hbWUiOiJDbG91ZGZsYXJlIiwiaXNwQXNuIjoiMTMzMzUifQ==

1 Like

cdn is actually a sub-domain.

One problem might be that the first half of its nameservers do not exist, only the second half actually resolves. Not sure if this is necessarily the issue but it is something you should fix.

While true, that doesn’t negate the fact that 1.1.1.1 doesn’t seem to be respecting the 30s TTL.

I only use the nameservers that Constellix give me. If half of them don’t resolve, that’s not my problem

It is, as your domain might not properly resolve in this case and that could also be the reason for the issue you experience. You need to clarify this with your host.

1 Like

In this case, that’s unlikely. the minimum nameservers for a zone are two, three are recommended. Most resolvers stop at one

It seems it is your problem, at least if you want your domain to work.

What is possibly happening here is that Cloudflare is intentionally returning a stale record because it’s otherwise getting a SERVFAIL (and typically a stale answer is better than none at all).

How is the number of resolvers related to your issue?

You simply have a broken domain configuration. Fix that and your issue might just get solved. If it then still does not work one could have a look.