Cache Configuration

NextDNS CLI can be used to cache DNS responses in memory. To enable caching, set a value greater than zero for the cache-size parameter. A value 10MB or less should be enough for most installations:

sudo nextdns config set -cache-size=10MB
sudo nextdns restart

The caching will obey individual records minimum TTL. Once the age of a record lived in the cache for more than its TTL, it becomes stale, and an upstream query is performed to refresh it. If for any reason, the upstream is not available, it will fallback on the stale record. This is adding some form of resiliency on top of the performance gain.

There is a way to cap the maximum TTL allowed for a record in the cache. It will not rewrite the TTL of the record as seen by clients of the CLI, but will cap the maximum age an entry can live in the cache before being considered stale. You can use the cache-max-age for that.

Automatic Cache Invalidation

When the upstream used is NextDNS with a custom profile ID, any change of this configuration will flush the associated cache. This is particularly useful when a whitelist entry is added to workaround a false positive for instance.

Although, when installed on a router, the clients themselves can have their own cached entry for this false positive. To workaround this issue, you can instruct NextDNS CLI to rewrite all TTL served to clients into a very low value like 5s. This way, they won't cache entries for more than this delay, and will mainly rely on the CLI's cache.

To set that up, use the max-ttl parameter as follow:

sudo nextdns config set -max-ttl=5s
sudo nextdns restart