The OneFS SmartConnect DNS server is designed to respond to delegated queries from a site DNS server for SmartConnect zones defined on the cluster. For load-balancing to be effective, it is critically important that the site DNS servers do not cache the results.

On the cluster side, the SmartConnect time-to-live (TTL) is configurable. The default is zero and should not be changed for normal use cases. To configure the TTL for a SmartConnect pool, use the following command:

isi network pools modify <pool id> --sc-ttl=0

For load-balancing to operate optimally, it is also important that the site DNS honors the TTL returned by the OneFS SmartConnect DNS server. If the site DNS “clamps the TTL,” it is possible for the site DNS server to erroneously return the same cached value if multiple client requests are received within the same “clamp window.”

Microsoft Windows DNS

Windows Server DNS 2003, 2008, 2012, 2016, and 2019, clamp the minimum TTL to one second. If many client requests are expected within a one-second timeframe, consider a different DNS server.

BIND DNS

Newer versions of BIND have introduced features that affect the SmartConnect ability to load balance. Depending on the BIND DNS version, consider the following information:

• BIND 9.12 introduced serve-stale functionality, which allows DNS resource records with an expired TTL to be returned if the DNS server is failing to resolve. Under normal operation, this feature does not cache records. However, during a SmartConnect error, if DNS records are still in the cache, this might affect load balancing.
• BIND 9.10.3/9.11 introduced new options to prevent DDOS attacks. The options include max-clients-per-query and clients-per-query, which bundle identical queries from clients and only send a single query to a recursive name server. The clients-per-query option is the baseline for when to start bundling, and max-clients-per-query is the cap on how many clients to bundle. For more details on these options, see https://www.isc.org/blogs/tldr-resolver-ddos-mitigation/.
• BIND 9.11 added options for fetches-per-server and fetches-per-zone. Fetches-absdsper-server is a self-tuning option that limits the n
• Number of outgoing requests to individual name servers. Fetches- per-zone limits the number of outstanding requests per zone. For more details on BIND 9.11, see https://bind.isc.org/doc/arm/9.11/Bv9ARM.html.

Note: In an event where these limits are engaged, multiple clients receive the same IP address, negating the SmartConnect ability to load balance connections. As a best practice, test these limits in a lab environment and understand how each of these features affects a specific workflow.