google / google/kctf

Set a low TTL on DNS records

Open
#202 1 comment 0 reactions 0 assignees View on GitHub
p2 ux
Dominant language
Go
Stars
794
Forks
82
PR merge metrics
No merged PRs in 30d

Description

By default we set a 5 minutes TTL
https://github.com/kubernetes-sigs/external-dns/blob/master/docs/ttl.md#google-provider

Which is cached in Cloud DNS for up to 2 minutes
https://cloud.google.com/dns/docs/monitoring#verifying_dns_propagation

We can't set a TTL of 0 (Cloud DNS doesn't allow it according to the first link above), and clients anyway seem to usually enforce a minimum TTL of 1 minute https://www.ctrl.blog/entry/dns-client-ttl.html

Looking at the behavior of intermediate caches, it appears as if the behavior of most of them is reasonable
https://00f.net/2011/11/17/how-long-does-a-dns-ttl-last/

It also seems like most services use low TTLs for various reasons https://00f.net/2019/11/03/stop-using-low-dns-ttls/

As such, setting an annotation of a TTL of 1 minute for CTF tasks seems reasonable. Note this means there will be 60ish seconds (up to 120 if someone queries just before the TTL of an intermediate cache expired and it enforced the minimum TTL of 60 seconds) during which kCTF will serve outdated records. In addition, we should review the negative TTL set by the default SOA record and adjust to 1 minute as well.

In practice, I think the minimum TTL enforced by intermediate resolvers isn't a concern. Google DNS and Cloudflare's seem to respect the TTLs, and we can expect CTF players to troubleshoot this themselves if they use their ISPs.

We could also set a super small TTL (2 seconds) as traffic is unlikely to be high and latency isn't as big of a concern for CTFs. It's probably more important for CTFs to have an up-to-date IP address.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.