Ecto connection pool retains stale IP after DNS change

Direct Answers

1. No built-in Ecto option forces re‑resolution on checkout. Resolution occurs once per connection when the adapter (Postgrex, MyXQL, TDS) opens the socket.
2. No pool‑level TTL setting exists. You must either recycle the pool (Repo.stop/1 then start) or configure Erlang’s global :inet resolver TTL.
3. Adapters use :inet_res for A/AAAA records only. They do not implement SRV lookup. If you pass an IP literal, DNS is bypassed entirely, but TLS hostname verification will fail unless certificates include the IP as a SAN.

Why This Happens

When a connection is checked out, the adapter calls :gen_tcp.connect/3 or :ssl.connect/3 with the hostname string from your repo config. Erlang’s :inet_res resolves that name once per connection attempt. The resolver caches results per‑process with an effectively infinite TTL unless you change the kernel parameter inet_db or call :inet_res.set_option/2 (OTP 26+). Existing pool processes keep their cached address until they are terminated and replaced.

Workarounds (No Pool Restart)

• Global resolver TTL: application:set_env(:kernel, :inet_db, {:dets, "/path/to/cache", 300}) (TTL in seconds). Affects all DNS in the node.
• Runtime IP injection: Resolve externally (e.g., a short‑lived GenServer that updates an ETS table), store the current IP as a literal in Application.put_env(:my_app, MyApp.Repo, hostname: "1.2.3.4"), then trigger new connections by briefly setting pool_size: 0 and back, or by using Repo.checkout/2 with a custom connection module that reads the IP at checkout time.
• Load‑balancer DNS: If your hostname resolves via a cloud LB (AWS NLB, GCP ILB) that returns a single IP per query, lowering the LB’s DNS TTL is often more effective than Erlang‑side changes.

Verification Steps

1. Start the repo against a hostname with two A records.
2. Change DNS to a third IP.
3. Run :inet.getaddr(hostname, :inet) from the pool process (via :observer or Process.whereis/1) to see the cached address.
4. Confirm SSL behavior by connecting with an IP literal and a cert lacking that IP in SAN—expect handshake failure.

One Diagnostic Detail Needed

Which adapter and Erlang/OTP version are you using? Postgrex on OTP 26+ can leverage :inet_res.set_option(:timeout, ms) per connection if you supply a custom connection module; MyXQL and TDS do not currently expose that hook.