How does the DNS resolution work on the ProxySG?
search cancel

How does the DNS resolution work on the ProxySG?

book

Article ID: 165929

calendar_today

Updated On:

Products

ProxySG Software - SGOS

Issue/Introduction

DNS requests sent from a client to the proxy are generally forwarded to the defined DNS server in the ProxySG Network Setup page.

Resolution

If you have defined more than one DNS server, the ProxySG uses the following logic to determine which servers are used to resolve a DNS host name and when to return an error to the client:

  • The ProxySG first sends requests to the DNS servers in the primary DNS server list.
  • (For SGOS 7.2.1 and SGOS 6.7.5.3 and earlier 6.7 releases) Servers are always contacted in the order in which they appear in the list.
  • (For SGOS 7.2.2 and all later 7.x releases, and SGOS 6.7.5.4 and later 6.7 releases) Servers are contacted in the order in which they appear if they are online. If a server is offline, it is skipped and the next online server is contacted.
  • The next server in the list is only contacted if the ProxySG does not receive a response from the current server.
  • If none of the servers in a list returns a response, the ProxySG returns an error to the client.
  • The ProxySG only sends requests to servers in the alternate DNS server list if a server in the primary list indicates that a DNS host name could not be resolved.

If a DNS server returns any other error (other than an indication that a DNS host name could not be resolved), the ProxySG returns the error to the client.

If a server in both the primary and alternate DNS server lists are unable to resolve a DNS host name, an error is returned to the client.

The ProxySG always attempts to contact the first server in the primary DNS server. If a response is received from this server, no attempts are made to contact any other DNS servers in the primary list.

In SGOS 7.2.1 and SGOS 6.7.5.3 and earlier 6.7 releases, if the response from the first primary DNS server indicates a name error, the ProxySG sends a DNS request to the first alternate DNS server, if one is defined. If no alternate DNS servers have been defined, an error is returned to the client indicating a name error. If the first alternate DNS server is unable to resolve the IP address, a name error is returned to the client, and no attempt is made to contact any other DNS servers in either the primary or alternate DNS server lists.

In SGOS 7.2.2 and all later 7.x releases if a response is not received from any DNS server in a particular DNS server list, the ProxySG sends a DNS request to the next server in the list. The ProxySG returns a name error to the client if none of the servers in a DNS server list responds to the DNS request.

NOTE:  The alternate DNS server is not used as a failover DNS server.  It is only used when DNS resolution of primary DNS server returns name error.  If a timeout occurs when looking up the primary DNS server, no alternate DNS server is contacted. For timeouts, additional servers in the primary group would be used for redundancy/failover.

If the ProxySG receives a negative DNS response (a response with an error code set to Name Error), it caches that negative response.  You can configure the ProxySGs negative response time-to-live value.  (A value of zero disables negative caching.) If the dns negative-cache-ttl-override is not configured (this is the default ProxySG setting), the ProxySG caches the negative response and uses the TTL value from the DNS response to determine how long it should be cached.  Please see the Command Line Interface (CLI) Reference for further information regarding the "dns negative-cache-ttl-override" setting.  The CLI reference can be downloaded from Command Line Interface Reference (6.7.x).

Additional Information


The changes in SG-28266 from 7.3.7.1 should drive DNS traffic to servers at the top of the list instead of only going down the list and sticking to a server that is responding with an answer.
 
The new code should use the health checks of the server as well as respect the order of the servers for preference from top to bottom.
 
After 6.7.5.4 and 7.2.2

SG-9432 Fixes an issue where the appliance's boot up was delayed or could not be completed if offline DNS servers appeared in the list of servers before online servers in the primary group or alternate groups if all primary DNS servers were offline.

After 6.7.5.16 and 7.3.7.1

SG-28266 Fixes an issue where the appliance did not honor the configured DNS server preference after a primary or
alternate server went offline and then came back online.