DDoS Attack Against Dyn Managed DNS
Out of curiosity, why do caching DNS resolvers, such as the DNS resolver I run on my home network, not provide an option to retain last-known-good resolutions beyond the authority-provided time to live?  In such a configuration, after the TTL expiration, the resolver would <i>attempt</i> to refresh from the authority&#x2F;upstream provider, but if that attempt fails, the response would be a more graceful failure of returning a last-known-good resolution (perhaps with a flag).  This behavior would continue until an administrator-specified and potentially quite generous maximum TTL expires, after which nodes would finally see resolution failing outright.<p>Ideally, then, the local resolvers of the nodes and&#x2F;or the UIs of applications could detect the last-known-good flag on resolution and present a UI to users (&quot;DNS authority for this domain is unresponsive; you are visiting a last-known-good IP provided by a resolution from 8 hours ago.&quot;).  But that would be a nicety, and not strictly necessary.<p>Is there a spectacular downside to doing so?  Since the last-known-good resolution would only be used if a TTL-specified refresh failed, I don&#x27;t see much downside.