<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body dir="auto"><div dir="auto">Please stop emailing me. Remove me from any list. You have and unsubscribe me. I do not wish to be emailed by this</div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><br></div><div id="composer_signature" dir="auto"><div style="font-size:85%;color:#575757" dir="auto">Sent from my Verizon, Samsung Galaxy smartphone</div></div><div dir="auto"><br></div><div><br></div><div style="font-size:100%;color:#000000" dir="auto"><!-- originalMessage --><div>-------- Original message --------</div><div>From: Eric Luehrsen via Unbound-users <unbound-users@lists.nlnetlabs.nl> </div><div>Date: 2/11/20 18:09 (GMT-07:00) </div><div>To: Talkabout <talk.about@gmx.de>, Benno Overeinder <benno@NLnetLabs.nl>, unbound-users@lists.nlnetlabs.nl </div><div>Subject: Re: AW: Unbound - Shared Cache </div><div><br></div></div>On 2/11/20 1:53 PM, Talkabout via Unbound-users wrote:<br>> Hi Benno,<br>> <br>> I have set up Unbound with redis Cache now and will check how well this <br>> works. I have one Question left: documentation states that unbound does <br>> NOT invalidate keys in the redis Cache even if they expire. Question <br>> from my side is why is unbound not simply using the „EXPIRE“ function of <br>> redis to set the TTL to the same time that unbound receives from an <br>> authority dns Server? That way no other maintenance Needs to be done. If <br>> there still is a valid reason (which I am sure there is 😊), what is the <br>> recommended way to cleanup redis?<br><br>If you want two truly independent recursive servers to share cache <br>results, then you should configure one as "primary" and the other as <br>"secondary". The primary is configured normally to recurse. The <br>secondary is configured to forward to the primary (clause <br>forward-zone:), but not exclusively (option forward-first: yes). Neither <br>has a dependency on a central database, so no single point failure. <br>Queries to the secondary will need to bounce through the primary. On a <br>whole network cold boot, the cache fill will demonstrate some delay. <br>Once rolling for an hour, no user will notice the difference. If the <br>primary fails, the secondary can just switch over to recursion itself <br>(forward-first: falls through).<br><br>If you wanted to experiment with a more corporate like configuration, <br>then you would set those two Unbound instances in a firewall-DMZ. These <br>two only listen to specific Unbound instances from within the firewall <br>intranet (clause server: option access-control:). The intranet Unbound <br>instances or dnsmasq if small office suites may only forward to the DMZ. <br>You prevent all clients from being able to use DNS (port 53/853) <br>externally. Their DHCP configuration only offers "nearest" two or three <br>intranet DNS servers, never DMZ, and never external access.<br><br>Anyway just a quick scratch of multi server configuration which is by no <br>means complete.<br>- Eric<br></body></html>