Configuring nginx Resolver Settings for ELB and Dynamic DNS Backends

When nginx sits behind ELB or other dynamic DNS backends, configure resolver settings so it does not keep stale IP addresses.

Takahiro Iwasa

2021-10-29

2 min read

When using AWS Elastic Load Balancer (ELB) or similar services that resolve to dynamic IP addresses, it’s crucial to properly configure nginx to manage DNS cache. Failing to address this can lead to issues as nginx may continue using outdated IPs.

Why DNS Cache Matters

Elastic Load Balancers often return different IP addresses for the same DNS name, making DNS caching problematic. By default, nginx caches DNS resolutions indefinitely, which can cause it to direct traffic to stale IPs.

The following nginx.conf demonstrates a standard setup that does not account for DNS caching. This configuration will fail when the ELB changes its IP addresses.

1
location / {
2
    proxy_set_header Host                   $host;
3
    proxy_set_header X-Real-IP              $remote_addr;
4
    proxy_set_header X-Forwarded-Host       $host;
5
    proxy_set_header X-Forwarded-Server     $host;
6
    proxy_set_header X-Forwarded-For        $proxy_add_x_forwarded_for;
7
    proxy_pass http://internal-xxx-alb-1234567890.ap-northeast-1.elb.amazonaws.com;
8
}

Adjusting nginx Configuration to Shorten DNS Cache TTL

To address this, you can explicitly define a DNS resolver with a shortened cache TTL.

1
location / {
2
    # Added to shorten cache TTL
3
    resolver 192.168.0.2 valid=60s;
4
    proxy_set_header Host                   $host;
5
    proxy_set_header X-Real-IP              $remote_addr;
6
    proxy_set_header X-Forwarded-Host       $host;
7
    proxy_set_header X-Forwarded-Server     $host;
8
    proxy_set_header X-Forwarded-For        $proxy_add_x_forwarded_for;
9
    proxy_pass http://internal-xxx-alb-1234567890.ap-northeast-1.elb.amazonaws.com;
10
}

resolver:
- Specifies the DNS server.
- The IP address of the DNS server for each VPC is the base of the VPC network range plus two (e.g., 192.168.0.2).
- Please refer to the official documentation.
valid=60s:
- Limits the TTL of cached DNS responses to 60 seconds, ensuring nginx frequently resolves fresh IPs.

Conclusion

Adding an explicit resolver directive with a short TTL keeps nginx from proxying to a stale ELB IP after the load balancer rotates addresses. Without it, nginx resolves the upstream hostname in proxy_pass once at startup or reload and caches that IP indefinitely, which quietly breaks once the ELB changes. resolver 192.168.0.2 valid=60s; — pointing at the VPC’s DNS server, which is always the network base address plus two — forces nginx to re-resolve every 60 seconds instead, keeping it aligned with whatever IPs the ELB is currently using. The same setting is worth applying to any upstream that resolves to dynamic IPs, not just ELB specifically, since the underlying caching behavior is identical regardless of what’s on the other end of the hostname.

Back to posts