A DNS name was queried before its record existed, and resolvers keep returning NXDOMAIN after you create it; what sets how long?

## Negative answers are cached too When a resolver asks about a name that does not exist, the authoritative server replies with the `NXDOMAIN` response code. When the name exists but has no records of the requested type, it replies `NOERROR` with an empty answer section, a response called **NODATA** (NODATA is a description, not a response code of its own). **Negative caching** is storing the knowledge that something does not exist. RFC 1034 treated negative caching as optional. **RFC 2308** (Standards Track) replaced that section and said negative caching should no longer be seen as optional, because it removes a large share of repeated queries for names that do not exist. ## Where the negative TTL comes from A negative reply has no record in its answer section to carry a TTL, so RFC 2308 uses the zone's **SOA** (start of authority) record: - The authoritative server **MUST** include the zone's SOA record in the **authority section** of an NXDOMAIN or NODATA reply, precisely so the reply can be cached. - The TTL of that SOA copy is set to the **minimum of the SOA record's own TTL and its `MINIMUM` field**. - That TTL is the **negative TTL**: how long a resolver may treat the name (or the name and type) as absent. - It counts down like any cached TTL. When a resolver answers from its negative cache it includes the SOA with the TTL **decremented** by the time already cached, so downstream caches expire together. - A negative reply **without** an SOA should not be cached: with no TTL to count down, two misconfigured servers forwarding to each other could keep the answer alive forever. ## A worked example ```dns example.com. 3600 IN SOA ns1.example.com. hostmaster.example.com. ( 2026100101 ; SERIAL 7200 ; REFRESH 900 ; RETRY 1209600 ; EXPIRE 86400 ) ; MINIMUM ``` 1. A monitoring check queries `api.example.com` before anyone has created it. 2. The authoritative server returns NXDOMAIN with the SOA in the authority section, TTL `min(3600, 86400)` = **3600**. 3. The resolver caches that negative answer for 3600 seconds. 4. Ten minutes later the record is created. Users of that resolver can keep getting NXDOMAIN for up to the remaining 50 minutes, even though the authoritative server now has the data. Had the SOA's own TTL been `86400` too, the wait would have been a full day. RFC 2308 advises resolvers to cap how long they cache negative answers anyway: one to three hours works well as a default, and more than a day has proved problematic. ## What a negative entry covers | Response | Cache key (RFC 2308 §5) | Consequence | |---|---|---| | NXDOMAIN | name + class | every record type at that name is treated as absent | | NODATA | name + type + class | only the type asked is absent; other types resolve normally | RFC 8020 adds that an NXDOMAIN means nothing exists **at or below** that name, and says a caching resolver should treat names underneath it as nonexistent too. So a cached NXDOMAIN for `api.example.com` can also answer for `v2.api.example.com`. Failures are handled differently. RFC 2308 §7.1 lets a resolver optionally cache a server failure, but for no longer than **five minutes**, since a failure says nothing about whether the name exists. ## The SOA MINIMUM field changed meaning The `MINIMUM` field in RFC 1035 was described as a minimum TTL for records in the zone, and was also used as a default TTL and as the negative TTL. RFC 2308 §4 untangled this: - the "minimum TTL for all records" meaning is deprecated (it was never used in practice); - the default TTL for records written without one moved to the master-file `$TTL` directive; - the only remaining meaning of `MINIMUM` is the **negative-caching TTL**. ## Avoiding the trap - Create records **before** anything queries them: monitoring, certificate checks, announcement emails. - Keep the SOA's TTL and `MINIMUM` modest so a mistaken early lookup costs minutes, not a day. - You cannot flush other people's resolvers; once a negative answer is cached, the only remedy is waiting out its TTL.