Module lessons (2/3)
Serve-stale and data freshness
Serve-stale and data freshness
Normally, a resolver refreshes or discards an answer after its TTL expires. Serve-stale allows a resolver, when it cannot refresh data, to return an expired answer temporarily instead of failing immediately. It is like using a backup copy of a directory while the central office is unreachable.
This can improve availability but reduces freshness: an old address may no longer be valid or safe. The resolver should attempt refresh, limit how long it serves stale data, and handle expired DNSSEC signatures and security-sensitive records such as DS or TLSA carefully.
For example, if an authority is unreachable and the resolver has api.example.test → 192.0.2.10, serving that stale answer may keep a service available if the address is still correct. If the address was reassigned, the same behavior can be dangerous. Serve-stale is a resolver policy, not a universal cancellation of TTLs. Define limits and monitor its use.
Reference: RFC 8767 — Serving Stale Data to Improve DNS Resiliency
Check your understanding
Choose the best answer. The examples use training names and do not send real DNS queries.
What is the trade-off with serve-stale?