The TTL value won't really help you here.
What you're seeing on your single machine is Standard Behavior for DNS, ping
, etc. If there are multiple addresses returned for a hostname, services will default to using the first one served in the DNS response.
Let me explain in an example.
Let's say I have a hostname with three A records. Those A records point to 192.168.10.1, 192.168.10.2, and 192.168.10.3 respectively for the same domain.
The DNS response will have any one of those addresses in the response. I.E. the actual DNS "Answer" could give them in the following order:
192.168.10.2
192.168.10.1
192.168.10.3
The same three records in a separate DNS query could return in this order too:
192.168.10.1
192.168.10.3
192.168.10.2
Therefore, when you're doing DNS resolution on a single hostname for the purposes of ping
and such, it has zero priority functionality, and the 'last response' it got will be 'cached' and that 'first' address used for the purposes of ping
, web requests, initializing connections to a hostname, etc.
There is no concept in ping
, etc. of "Test all IPs with different requests" - for that, you have to manually override the address at the /etc/hosts
level or ping the IP(s) directly. Typically speaking, if you have three addresses for a single domain record, you should be pinging the IP addresses independently, and not trust the 'hostname' resolution to be proper.
Further, unless you've removed systemd-resolved
from the equation, that's a caching resolver on your end, and will 'cache' that initial IP response for the mail server (in my example, .2 was the first address in the response, so it caches that one. if I restart that process on system and flush its cache and the DNS server it queries returns .1 first, then .1 gets cached as the 'result' for the first DNS hostname, as well as the other three entries.)