40

If a DNS server looks up a record and it's missing, it will often "negatively cache" the fact that this record is missing, and not try to look it up again for a while. I don't see anything in the RFC about the TTL on negative caching should be, so I'm guessing it's somewhat arbitrary. In the real world, how long do these negative records stick around for?

51

The TTL for negative caching is not arbitrary. It is taken from the SOA record at the top of the zone to which the requested record would have belonged, had it existed. For example:

example.org.    IN      SOA     master-ns1.example.org. Hostmaster.example.org. (
            2012091201 43200 1800 1209600 86400 )

The last value in the SOA record ("86400") is the amount of time clients are asked to cache negative results under example.org..

If a client requests doesnotexist.example.org., it will cache the result for 86400 seconds.

  • 1
    @MarcusAdams ...and a client won't negative-cache any records on SERVFAIL. The TTL in the SOA record is, in fact, used for negative caching. That's why the SOA record is produced in NXDOMAIN answers. – Celada Jul 17 '16 at 11:45
  • 3
    @MarcusAdams Correct. If you get a SERVFAIL then you don't get a SOA nor a TTL. There is no answer for you to negative-cache. If instead you get a NXDOMAIN than you do get a SOA, with a TTL. You will negative-cache that response for the duration of the TTL. – Celada Jul 20 '16 at 20:37
  • Beartrap for DNS RBL users: since RBL answers tend to be minimal (and the DNS server implementation possibly non-conforming) you might not get an SOA with the NXDOMAIN answer. This may mean your DNS cache doesn't cache NXDOMAIN (i.e. the non-spammers) at all :-/ – mr.spuratic Nov 22 '17 at 16:26
8

This depends on your exact definition of a "negative query", but in either case, this is documented in rfc2308 «Negative Caching of DNS Queries (DNS NCACHE)»:


NXDOMAIN

  • If the resolution is successful, and results in NXDOMAIN, the response will come with a SOA record, which would contain the NXDOMAIN TTL (traditionally known as the MINIMUM field). rfc2308#section-4

SERVFAIL

  • If the resolution is not successful, and results in a timeout ( SERVFAIL), then it may as well not be cached at all, and in all circumstances MUST NOT be cached for longer than 5 minutes. rfc2308#section-7.1

    Note that in practice, caching such results for the full allowable 5 minutes is a great way to diminish the experience of a client should their cache server occasionally suffer brief connectivity issues (and effectively make it easily vulnerable to a Denial-of-Service amplification, where a few seconds of downtime would result in the certain parts of the DNS being down for the five full minutes).

    Prior to BIND 9.9.6-S1 (released in 2014), apparently, SERVFAIL was not cached at all. a878301 (2014-09-04)

    E.g., at the time of your question and in all versions of BIND released prior to 2014, the BIND recursive resolver DID NOT cache SERVFAIL at all, if the above commit and the documentation about the first introduction in 9.9.6-S1 is to be believed.

    In the latest BIND, the default servfail-ttl is 1s, and the setting is hardcoded to a ceiling of 30s (in place of the RFC-mandated ceiling of 300s). 90174e6 (2015-10-17)

    Furthermore, the following are some noteworthy quotes on the matter:

    The outcome of caching SERVFAIL responses has included some situations where it was seen to be detrimental to the client experience, particularly when the causes of the SERVFAIL being presented to the client were transient and from a scenario where an immediate retry of the query would be a more appropriate action.

    The second tactic is to claim that widespread DNS clients will do something Particularly Evil when they are unable to reach all DNS servers. The problem with this argument is that the claim is false. Any such client is clearly buggy, and will be unable to survive in the marketplace: consider what happens if the client's routers briefly go down, or if the client's network is temporarily flooded.


In summary, an NXDOMAIN response would be cached as specified in the SOA of the applicable zone, whereas SERVFAIL is unlikely to be cached, or, if cached, it'll be at most a double-digit number of seconds.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.