DNS Scavenging: Why Stale Records Vanish

DNS scavenging is the automatic removal of stale resource records from a DNS zone. When a machine’s IP address changes and the old record is not updated, the record becomes stale. Scavenging exists to keep zones tidy, but misconfigured scavenging deletes records that are still in use, causing name resolution failures. This page explains the mechanism, the settings that control it, and the common misdiagnosis that leads to data loss.

How Stale Records Accumulate

DNS records are created dynamically when a client registers its name and IP address with the DNS server. This happens when a machine boots, joins a domain, or renews its DHCP lease. The DNS server stores the record with a timestamp. If the client later changes its IP address, it sends an update to the DNS server to modify the record. If the client cannot send the update—because it crashed, was disconnected, or was turned off—the old record remains. Over time, these stale records accumulate. They point to IP addresses that no longer correspond to the machine, causing clients to connect to the wrong address or fail to connect at all.

Aging and Scavenging: The Mechanism

Aging is the process of marking records with a timestamp and calculating when they become eligible for removal. Scavenging is the actual deletion of those records. Both are controlled by settings on the DNS server and on the zone.

Timestamps

When a record is created dynamically, the DNS server stamps it with the current time. This timestamp is stored in the record’s property. Static records—those created manually by an administrator—do not receive a timestamp by default. Without a timestamp, a record is never scavenged. This is a deliberate safety measure: static records are assumed to be intentional and permanent.

The Scavenging Cycle

Scavenging runs on a periodic basis. The DNS server checks all records in zones that have scavenging enabled. For each record with a timestamp, the server compares the timestamp to the current time. If the record is older than the no-refresh interval plus the refresh interval, it is deleted. The intervals are set on the zone.

• No-refresh interval: The period after a record is created or updated during which the DNS server will not accept a refresh from the client. This prevents a client from updating its record too frequently, which would cause unnecessary replication traffic.
• Refresh interval: The period after the no-refresh interval during which the DNS server will accept a refresh. If the client refreshes its record during this window, the timestamp is updated, and the record is no longer considered stale. If the client does not refresh, the record becomes eligible for scavenging.

The total age at which a record is scavenged is the sum of the two intervals. For example, if the no-refresh interval is 7 days and the refresh interval is 7 days, a record that is not refreshed within 14 days will be deleted.

Scavenging Settings

Scavenging is controlled by three levels of settings:

1. Server-level: The DNS server has a setting to enable or disable scavenging. This is a global switch. If it is off, no scavenging occurs on that server.
2. Zone-level: Each zone has its own scavenging settings. A zone can have scavenging enabled or disabled, and the intervals are set here. The zone settings override the server defaults.
3. Record-level: Individual records can have a timestamp or not. Static records lack a timestamp and are never scavenged.

To enable scavenging on a zone, you must first enable it on the server, then on the zone. The intervals are set on the zone. If the server-level setting is off, the zone setting has no effect.

The Silent Deletion: Why Records Vanish

The most common problem with scavenging is that it deletes records that are still in use. This happens when the intervals are set too short, or when a client fails to refresh its record for reasons unrelated to its actual state.

Short Intervals

If the no-refresh and refresh intervals are set to very short values—for example, 1 day each—a record that is not refreshed for 2 days will be deleted. This can happen if a client is offline for a few days, or if the client’s DNS registration is disabled. The record is deleted even though the machine is still a valid member of the network and will return.

Client Refresh Failures

Clients refresh their DNS records when they renew their DHCP lease or when the DNS client service restarts. If a client is configured with a static IP address, it may not refresh its record at all. The DNS client service on Windows machines refreshes records periodically, but this can be disabled or fail. If the client does not refresh, the record ages and is eventually scavenged.

The Misdiagnosis: “DNS Scavenging Is Broken”

When a record disappears, the immediate assumption is that scavenging is malfunctioning. The record was there yesterday and is gone today. The natural conclusion is that the DNS server has a bug or that scavenging is too aggressive. This is a natural mistake because the symptom—a missing record—is identical to what would happen if scavenging were misconfigured. But the mechanism is working as designed. The record was deleted because it met the criteria for deletion: it had a timestamp, it was older than the sum of the intervals, and no refresh was received. The problem is not the scavenging process itself but the configuration that made the record eligible.

Why It Is a Natural Mistake

Administrators often enable scavenging to clean up stale records, then set the intervals based on a guess. They might choose 7 days for both intervals, thinking that any record older than 14 days is definitely stale. But a laptop that is turned off for two weeks will have its record deleted. When the user returns and the laptop boots, it registers a new record, so the problem is temporary. But if the laptop is off for a month, or if the user’s machine is a server that is rarely rebooted, the record is gone for good. The administrator sees the missing record and blames scavenging, not the interval setting.

What People Get Wrong About Scavenging

The biggest misconception is that scavenging only removes records that are truly stale. In reality, scavenging removes any record that has not been refreshed within the configured intervals, regardless of whether the machine is still in use. A record for a server that has been running for months without a reboot will be deleted if the server does not refresh its record. The server’s IP address is correct, but the record is gone because the server did not send a refresh.

Another common error is enabling scavenging on a zone that contains static records. Static records do not have timestamps, so they are safe. But if a static record is later converted to dynamic—for example, by a DHCP registration—it will receive a timestamp and become eligible for scavenging. This can happen accidentally.

How to Configure Scavenging Safely

To avoid deleting records that are still needed, follow these guidelines:

• Set the no-refresh and refresh intervals to values that are longer than the longest expected period without a refresh. For most networks, 7 days for each interval is a reasonable starting point, but consider the machines that are often offline. If you have laptops that are turned off for weeks, increase the intervals.
• Enable scavenging only on zones that contain dynamic records. Static zones, such as those for internal servers, should have scavenging disabled.
• Monitor the scavenging activity. The DNS server logs scavenging events in the DNS server event log. Look for event ID 2501, which indicates that a record was scavenged. If you see records being deleted that you did not expect, adjust the intervals.
• Test scavenging in a lab before enabling it in production. Create a few test records, set short intervals, and observe what happens.

Commands to Check and Configure Scavenging

To view the current scavenging settings on a zone, use the dnscmd command:

dnscmd /ZoneInfo <zone-name> /Scavenging

The output shows whether scavenging is enabled and the current intervals. To enable scavenging on a zone, use:

dnscmd /ZoneResetScavenging <zone-name> /Scavenging /NoRefresh <interval> /Refresh <interval>

Replace <interval> with the number of hours. For example, to set both intervals to 7 days (168 hours), run:

dnscmd /ZoneResetScavenging example.com /Scavenging /NoRefresh 168 /Refresh 168

To enable scavenging on the server, use:

dnscmd /Config /ScavengingInterval <hours>

The scavenging interval is how often the server checks for stale records. The default is 168 hours (7 days). The server must have scavenging enabled for the zone setting to take effect.

Comparison Table

Conclusion

DNS scavenging is a powerful tool for keeping zones clean, but it operates on a simple rule: delete records that have not been refreshed within a set time. The rule does not know whether a record is truly stale or just temporarily unused. Understanding the mechanism allows you to predict when a record will be deleted and to configure scavenging so that it removes only what you intend. The key is to set intervals that accommodate the longest expected absence of a client, and to enable scavenging only on zones that need it.