Why cache/TTL expirations >1 hour are stupid.

[indolering]

TTL is the value that is used to force the local DNS resolver to do a look-up on the domain name/IP mapping. This is crazily inefficient compared to just passing around a bloom filter to check if a domain name has changed.

Say we wanted to create a bloom filter that would track what domains have changed for all of the 250 million registered domains in the past hour. We could simply leave in the cache timings for domains with TTS less than an hour old. And the rule of thumb for DNS changeovers used to be ~1 day, that is kinda the maximum now.

Assuming that 1% of all domains change their records every hour we would need a bloom filter capable of categorizing 2,500,000 domains. Assuming we are comfortable with a 1% false positive "rate" (which is WAY lower in practice as 20% of the domains get 80% of the traffic) would would need ... *maths* ... 7 hash filters and a 2.86MB array to be transmitted every hour. And that is for the ENTIRE internet, including those domains with TTS <1 hour old.

There is no point to this post, other than to say that TTS is silly. I have access to the nightly root zone files, if anyone wants to tell me how to parse the data :p