DNS Conditional Forwarder - Cache?

Question

Hi all, I am looking for a definitive answer here as struggling to find anything official. I have an AD integrated DNS server infrastructure. I have a single DNS conditional forwarder setup to forward all DNS requests for a customer domain directly to that customers DNS server for resolution. While this all works as expected, the question I have is... do my DNS servers cache the requests I make over that forwarder? So for example, a client makes a DNS request to the AD DNS server to partner.com and the AD DNS server in turn sends it across to the partner servers via the conditional forwarder. Does that request get cached at either the AD DNS server, OR the windows client itself? Or does every single request to this partner domain go across the conditional forwarder regardless?

And how can I prove it one way or the other?

Answer 1

Hello @Lamby

Windows DNS Client has DNS cache.
The default TTL for positive responses is 86,400 seconds (1 day).
The default TTL for negative responses is 5 seconds; prior to Windows 10, version 1703 the default was 900 seconds
https://learn.microsoft.com/en-us/windows-server/networking/dns/troubleshoot/disable-dns-client-side-caching#using-the-registry-to-control-the-caching-time

In Windows Server there is caching of the forward query. Caching is always in place for any forwarded query (conditional or forwarder)
https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/forwarders-resolution-timeouts

Answer 2

I had a feeling this was the case. So one other related question... does it make any difference at all if you are resolving a CNAME to an A record or do they both cache on the windows client in the same manner?

Answer 3

Yeah, I was aware of this part. My question is, we are seeing specific issues when resolving CNAMES on the customers DNS server. It takes a significant amount of time each time we query a CNAME over the conditional forwarder than it does an A record. So my thoughts were that perhaps it doesnt cache CNAME lookups and we have to go to the forwarder every time.

Answer 4

Hi,

Thanks for posting in Q&A platform.

I performed some tests in my lab and found that when DNS client initiate a DNS request, when this DNS request was forwarded to conditional forwarder and responded successfully, it can be cached on client side and cannot be cached on both DNS servers. No matter what the DNS query is, this record can be cached on client side with specific TTL.

If you want to perform a test, I would suggest you could run command "ping CNAME record on conditional forwarder" "ipconfig /displaydns" in a CMD window with Admin privilege from client side to check if the CNAME record was cached on client.

Attaching my test results for your reference.

Prerequisites：

Domain lab.com DC: labdc1.lab.com
IP address: 192.168.0.106

Domain sunny.com DC: dc1.sunny.com
IP address: 192.168.0.101

Windows 10 client: labwin10.lab.com
IP address: 192.168.0.115

On DC of lab.com, I configured DC of sunny.com as conditional forwarder:

CNAME record on conditional forwarder:

Run command "ping testserver.sunny.com" from windows 10 client side and get the correct response as below:

And then run command "ipconfig /displaydns" and found that this CNAME record was cached on win 10 client side:

Hope my answer will help you.

Best Regards,
Sunny

----------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 5

Many thanks for the detail Sunny. I wish this thing would let me mark 2 things as the answer as you have both answered each of my two questions.