I read https://tools.ietf.org/html/rfc2606 and https://tools.ietf.org/html/rfc6761, but I still do not get some details. Why do https://tools.ietf.org/html/rfc2606 does not explicitly says which response code we should return for the reserved domain? Is the purpose of https://tools.ietf.org/html/rfc6761 to add additional details?

In https://tools.ietf.org/html/rfc6761, they say:

Instead, caching DNS servers SHOULD, by default, generate immediate negative responses for all such queries

Is negative a NXDOMAIN or REFUSED? or is it up to the developer? At the beginning of the same RFC, it is written:

For this special "guaranteed nonexistent" name to have any use, it has to be defined to return NXDOMAIN

Is it applicable here? This is not clear to me why they use the term "negative response". Also, is this RFC implemented in real world? it looks like dig still query the root servers for those reserved domains.


The NXDOMAIN and negative responses are used interchangeably, as that's how they are defined in RFC 2308, 2 and clarified in RFC 8020; the RFC 6761 is standardizing the Special-Use Domain Names, not the DNS response codes.

It's also worth to mention that this does not apply to all reserved domains, but more specifically

  • the in-addr.arpa. domains for RFC 1918 private addresses, i.e. 10.in-addr.arpa. for 10./8, 168.192.in-addr.arpa. for 192.168./16 and all the 172.16./12 as listed in RFC 6761, 6.1
  • and TLDs test. (6.2) , localhost. (6.3) & invalid. (6.4),
  • but not to example., example.com., example.net. & example.org. that should be handled normally (6.5). (E.g. example.com. IN A

Also, is this RFC implemented in real world?

If you dig -x, you should get an NXDOMAIN for IN PTR from any recursive name server, but an authoritative server for the private network may answer what ever applies locally.

This is implemented e.g. in BIND by

  1. named.conf.local:

    // Consider adding the 1918 zones here, if they are not used in your
    // organization
    //include "/etc/bind/zones.rfc1918";
  2. /etc/bind/zones.rfc1918:

    zone "10.in-addr.arpa"      { type master; file "/etc/bind/db.empty"; };
    zone "16.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
    . . . 
  3. /etc/bind/db.empty:

    ; BIND reverse data file for empty rfc1918 zone
    ; DO NOT EDIT THIS FILE - it is used for multiple zones.
    ; Instead, copy it, edit named.conf, and use that copy.
    $TTL    86400
    @       IN      SOA     localhost. root.localhost. (
                                  1         ; Serial
                             604800         ; Refresh
                              86400         ; Retry
                            2419200         ; Expire
                              86400 )       ; Negative Cache TTL
    @       IN      NS      localhost.

This guarantees the NXDOMAIN replies on recursive name servers, instead of using the root servers from

zone "." {
        type hint;
        file "/usr/share/dns/root.hints";
| improve this answer | |
  • Thank you for this amazing detailed answer! – vinz Jun 21 at 7:14

NXDOMAIN is a negative response. REFUSED is a refusal to provide service, and is not applicable here.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.