Is DNS address-list-extra-time option working?

RouterOS General
1

Hello all anons and MT staff.
Can somebody confirm address-list-extra-time option working for dns cache?
Got some asics (~600)- they’re requestrin dns a lot.
Using RB951U, ROS 7.16.2 FW 7.16.2. CPU load 80-100%

Asics are given RB as dns server via dhcp. DNS ttl is set to 8d, address-list-extra-time is set to 1d, but cached dns entries show ttl several minutes.
And RB have to make tons of dns requests to ISP’s servers.

[admin@gw-nsk-asic-mt] <SAFE> /sys reso pr
                   uptime: 1h18m2s
                  version: 7.16.2 (stable)
               build-time: 2024-11-26 12:09:40
         factory-software: 6.46.6
              free-memory: 73.0MiB
             total-memory: 128.0MiB
                      cpu: MIPS 74Kc V4.12
                cpu-count: 1
            cpu-frequency: 600MHz
                 cpu-load: 97%
           free-hdd-space: 109.6MiB
          total-hdd-space: 128.0MiB
  write-sect-since-reboot: 510
         write-sect-total: 23986
               bad-blocks: 0%
        architecture-name: mipsbe
               board-name: RB951Ui-2HnD
                 platform: MikroTik




[admin@gw-nsk-asic-mt] <SAFE> /ip dns p
                      servers: 10.104.241.42,10.104.241.50
              dynamic-servers: 10.104.241.42,10.104.241.50
               use-doh-server: 
              verify-doh-cert: no
   doh-max-server-connections: 5
   doh-max-concurrent-queries: 50
                  doh-timeout: 5s
        allow-remote-requests: yes
          max-udp-packet-size: 4096
         query-server-timeout: 2s
          query-total-timeout: 10s
       max-concurrent-queries: 512
  max-concurrent-tcp-sessions: 128
                   cache-size: 4096KiB
                cache-max-ttl: 1w1d
      address-list-extra-time: 1d
                          vrf: main
           mdns-repeat-ifaces: 
                   cache-used: 38KiB

For example:

[admin@gw-nsk-asic-mt] <SAFE> /ip dns ca p de
Flags: S - static 
 0   type=CNAME data=ltcssl.f2pool.com.cdn.cloudflare.net. name="ltcssl.f2pool.com" ttl=2m26s 

 4   type=CNAME data=ltc.sr.f2pool.com. name="ltc-na.f2pool.com" ttl=3m14s 

 5   type=CNAME data=ltc.sr.f2pool.com. name="ltc-euro.f2pool.com" ttl=3m14s

address-list-extra-time: 1d ttl=2m26s, ttl=3m14s why?

2

“address-list-extra-time” works in combination with “address-list” of static dns entries. It has no effect on these dynamic entries you printed. see docs on the topic over here: https://help.mikrotik.com/docs/spaces/ROS/pages/37748767/DNS

3

I thoroughly read and even searched this document, but where exactly at that man page is that written?

4

Content deleted by author.

5

It's a global setting under IP -> DNS. Not of the individual static record entries!

image
image852×300 13 KB

6

Content deleted by author.

7

Here:

image

And the other two occurrences of address list on that page:

image

should be enough to let you know that the setting and feature is related to adding entries to Firewall address list, not the life time of the entries in the DNS cache!

8

Sorry for drifting away from original topic a little, but I’d like to clarify a few things related to address-list-extra-time:

  1. How does address-list-extra-time corresponds with cache-max-ttl? Can address list entry have ttl that is higher that those two combined, or cache-max-ttl is only for cache and does not affect address-list entries?

  2. If a name which was already added to address-list is looked up again (and matched co-responding rule), how exactly would that affect existing entry? Especially if new resolved addresses are different from previously added?

  3. What is the correct syntax to match only subdomain but not the main one? Like *.example.com but not example.com itself? (I know that regexp for that would be ^([a-zA-Z0-9-]+.)+example.com$ but can it be achieved with just name field syntax?)

PS since timeout field for dynamically added address list entries is empty, it’s hard to tell how things work.