It has been a well known fact for many years (to some of us at least) that ColdFusion (or rather the JRE) caches DNS look-ups forever until the service is next restarted.
The caveat of this is that if any domain name you are connecting to from CFML has had a DNS change such as a change of IP address then code will suddenly stop working until you next restart CF.
Areas that will affect include:-
- SMTP servers in the CFADMIN
- Database Servers in your Datasources
- CFHTTP calls
- Web Services
- CFFTP, CFPOP, CFEXCHANGEMAIL, CFIMAP, CFMAIL
Plus any other tag, CFX tag, java class that allows you to connect to a remote server.
This has never really caused us any major issues, occasionally we had had a customer complain that CFHTTP calls have mysteriously stopped working, or that they could no longer connect to their payment gateway after the provider made some updates, but it has been so rare that restarting CF was an acceptable solution.
Recently we got a notice from our payment gateway provider (SagePay formerly ProtX) telling us that their IP addresses would change. Knowing this would affect CF and that we have several customers who also used SagePay I knew we would have to restart CF on every server to make sure their ecommerce stores did not break.
This prompted me to look into this problem, find out why the JRE cached DNS look-ups and see if I could change it.
After some investigation I learned that the class used to lookup host names for HTTP operation is the Java InetAddress class
If You read the above page you can see that the result of positive host name resolutions is cached forever, it also advises how to override the default behaviour with the following property.
networkaddress.cache.ttl
Indicates the caching policy for successful name lookups from the name service. The value is specified as as integer to indicate the number of seconds to cache the successful lookup. The default setting is to cache for an implementation specific period of time.
In a standard ColdFusion installation you would find this in the following file:-
C:\ColdFusion8\runtime\jre\lib\security\java.security
If you are using a custom JRE in a J2EE type installation then the path may be something like:-
C:\Program Files\Java\jdk1.6.0_12\jre\lib\security\java.security
In a CF multi-server installation:-
C:\JRun4\jre\lib\security\java.security
Find the following line
#networkaddress.cache.ttl=-1
and change it to
networkaddress.cache.ttl=14400
This sets the TTL to 14400 seconds (4 hours).
Now you will note that there are various warnings about DNS cache poisoning and the security manager which may scare you. So also note that InetAddress by default resolves against localhost, so if there was a cache poisoning problem then the problem is with your local machine or DNS server thus any application that resolves DNS lookup-up against localhost will be affected, which includes ASP, PHP, local services etc, so ColdFusion/Java is really not where you area of concern should be when it comes to DNS, but rather that your local machine is secure and that your DNS server is protected against cache poisoning. Plus the problem would still exist when you restart CF anyway, and this is probably a fairly common occurrence for most people, so I personally would not worry about it and I think this is a pretty daft and pointless reason for this default setting. Some may disagree, but hey that's their prerogative.
Recent Comments