(I posted this earlier as a limitation of DNS based address list, it may partly be there)
I am using a DNS defined address list. It is a long list of addresses. The DNS server returns 2392 A records for the DNS name in the list.
It worked OK when the DNS name was 17 characters long, but I had to change it to another name, now it is 21 characters long, and it fails
to load the address list. I can still get it to work by using 2 different names (22 characters each) and putting 2 items in the same address
list. The list then contains the full 2392 items. But as there is no guarantee that both items in the address list will be updated at the
same time, there could be discrepancies when the content of the list changes and one half is updated and the other half isn’t (yet).
So I would like to keep using a single DNS name holding all addresses, and would like it to hold more than this (e.g. 5000).
At first I believed the processing in the address list has its limitations, but then I found that when the address list fails to retrieve the
addresses using a DNS lookup, the DNS Cache does not contain all the addresses, the tail end is omitted. I now think in this case the
DNS reply is being processed by the resolver, the items put in the cache, but once it hits some limit it stops processing and does not
return the reply to the requestor (the DNS resolving in the address list). Indeed, when I try to request the DNS name from a system on
the LAN (using the resolver in the MikroTik), I get no reply at all (and a timeout after some time).
It appears the maximum size of the reply is depending on the product of requested DNS name length and number of items. With a shorter
name one can request more items. It appears to be about 45K (2392 items and a 17-char DNS name works, with a 21-char name it doesn’t).
(it is a bit strange, because the actual size of the reply does not increase with the product of name length and number of entries. but
it could be the memory usage of the DNS cache does, and it is limited in some way how much memory a single request may consume)
Is there any way to work around this? I see some settings in the DNS resolver w.r.t. total cache size and number of open requests but it does
not appear to affect this particular limit.