It comes with a validity counter in seconds, and you can be very very loose about counting those seconds.

It's not the hard kind of cache invalidation. You don't really have to do "invalidation" at all.

And on the server side, it's perfectly acceptable to send a mix of old and new versions for a while.

That definitely helps things to work, but it makes it very much more difficult to work out why things might not be working.

Not least because an unexpected cache can lead to things looking like they're working when they're actually broken at source, as well as things looking like they're still broken when you've actually fixed them at source already.

"I didn't know that cache existed" isn't because of the difficulty of invalidating the right items, though.

And the occasional cache that keeps things forever is so extra broken that it's not doing that because cache invalidation is hard, it's either a supreme misunderstanding or it's incompetence.

Sadly reboot the VM is still a valid step in debugging DNS, while you google "clear cache for this type of client resolver"

Also, the dreaded caching of negative results/authoritative no such domain just before you get the new domain working properly.

> And the occasional cache that keeps things forever is so extra broken that it's not doing that because cache invalidation is hard, it's either a supreme misunderstanding or it's incompetence.

Working in phone technical support in the early 2000s, I encountered first in CF6 and then at least one J2EE implementation (Websphere, maybe?) where the $^&#ing default was to cache DNS results forever.

The behavior was borderline undocumented, and the setting to fix it was even less well documented. It's like they wanted DNS to not be a thing.

> It's not the hard kind of cache invalidation. You don't really have to do "invalidation" at all.

One of the points he brings up is negative cache, or caching the dns into a state that it won’t retrieve a resolved address even if it’s available simply because the negative case is cached.

Invalidation is definitely a part of it, mostly because you kind of can’t.

You sometimes can perform an invalidation, but it's a manual process and you need to know who to ask. Slack did this when they botched their DNSSEC rollout[1]:

> Our team quickly started contacting major ISPs and operators that run public DNS resolvers, with the request to flush all cached records for slack.com.

DNSSEC is another part of DNS that is still hard to learn.

[1] https://news.ycombinator.com/reply?id=36910054&goto=item%3Fi...

you forgot the second, off-by-one errors.

Yes, but not a joke.