Publishing an incomplete copy of your zone seems like a bad idea, an ANY dig at the zone apex is going to retrieve less than 30% of the records (on average) for real-world zones. Negative responses in DNS are cacheable - so you can easily poison yourself.
If you really really want to do it anyway, most caches use either the TTL on your SOA record, or the final field in the SOA record as the negative cache TTL; so lower both of those values to something like 60 seconds.
Hmm, never considered that. Is it a slow, static process for ISPs to do that? I just assumed that they ran more-or-less stock DNS resolvers with in-memory caches.
Comments
For anyone else who needs to mitigate this in a hurry:
Set up a new account on another host that does ALIAS records (I used pointDNS)
Create your new record without much in it
Change your nameservers on your domain now - they'll take time to propagate
Fill in the records on your domain. If you can't remember them, print out most of your existing records with
dig yourdomain.com ANY
Add the rest of the records to pointDNS
Wait for the new Nameservers to propagate (0-24 hours - it took 15-30 min for us on a small-medium traffic domain today during sales crunch)
Publishing an incomplete copy of your zone seems like a bad idea, an ANY dig at the zone apex is going to retrieve less than 30% of the records (on average) for real-world zones. Negative responses in DNS are cacheable - so you can easily poison yourself.
If you really really want to do it anyway, most caches use either the TTL on your SOA record, or the final field in the SOA record as the negative cache TTL; so lower both of those values to something like 60 seconds.
For those with a more deterministic bent: "propagation" time has a maximum bound of your TTL, which will show with any dig queries.
Propagation is bound at the DNS TTL plus whatever time it takes your DNS provider/setup to relay records to all of its authoritative servers.
Hmm, never considered that. Is it a slow, static process for ISPs to do that? I just assumed that they ran more-or-less stock DNS resolvers with in-memory caches.