NSCD TTL and DNS TTL, which one is stronger?

Solution 1:

It's important to note that nscd acts as a cache for the resolver system in general, not specifically for DNS lookups but all means of name lookups.
As a result of this, nscd has historically had issues dealing with the DNS TTLs.

Versions of glibc nscd from before 2004-09-15 did not deal properly with DNS TTLs.
When that was resolved, glibc nscd still only dealt with DNS TTLs if the application called getaddrinfo; if an application called the obsolete gethostbyname functions the DNS TTL values were still ignored.

To my understanding the glibc maintainers finally caved in glibc 2.8 (2008) and made the behavior consistent across all the name lookup methods. Current versions should use the DNS TTLs regardless of how the lookup was initiated.

See also:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=335476
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=669304
https://sourceware.org/ml/libc-alpha/2008-04/msg00050.html
https://sourceware.org/bugzilla/show_bug.cgi?id=4428
http://udrepper.livejournal.com/16362.html