If a DNS server looks up a record and it's missing, it will often "negatively cache" the fact that this record is missing, and not try to look it up again for a while. I don't see anything in the RFC about the TTL on negative caching should be, so I'm guessing it's somewhat arbitrary. In the real world, how long do these negative records stick around for?
The TTL for negative caching is not arbitrary. It is taken from the SOA record at the top of the zone to which the requested record would have belonged, had it existed. For example:
example.org. IN SOA master-ns1.example.org. Hostmaster.example.org. ( 2012091201 43200 1800 1209600 86400 )
The last value in the SOA record ("86400") is the amount of time clients are asked to cache negative results under
If a client requests
doesnotexist.example.org., it will cache the result for 86400 seconds.
This depends on your exact definition of a "negative query", but in either case, this is documented in rfc2308 «Negative Caching of DNS Queries (DNS NCACHE)»:
- If the resolution is successful, and results in
NXDOMAIN, the response will come with a
SOArecord, which would contain the
NXDOMAINTTL (traditionally known as the
If the resolution is not successful, and results in a timeout (
SERVFAIL), then it may as well not be cached at all, and in all circumstances MUST NOT be cached for longer than 5 minutes.
Note that in practice, caching such results for the full allowable 5 minutes is a great way to diminish the experience of a client should their cache server occasionally suffer brief connectivity issues (and effectively make it easily vulnerable to a Denial-of-Service amplification, where a few seconds of downtime would result in the certain parts of the DNS being down for the five full minutes).
Prior to BIND 9.9.6-S1 (released in 2014), apparently,
SERVFAILwas not cached at all.
E.g., at the time of your question and in all versions of BIND released prior to 2014, the BIND recursive resolver DID NOT cache
SERVFAILat all, if the above commit and the documentation about the first introduction in 9.9.6-S1 is to be believed.
In the latest BIND, the default
1s, and the setting is hardcoded to a ceiling of
30s(in place of the RFC-mandated ceiling of
Furthermore, the following are some noteworthy quotes on the matter:
- https://kb.isc.org/article/AA-01178/ (2014/2016-01-07)
The outcome of caching SERVFAIL responses has included some situations where it was seen to be detrimental to the client experience, particularly when the causes of the SERVFAIL being presented to the client were transient and from a scenario where an immediate retry of the query would be a more appropriate action.
- http://cr.yp.to/djbdns/third-party.html (2003-01-11)
The second tactic is to claim that widespread DNS clients will do something Particularly Evil when they are unable to reach all DNS servers. The problem with this argument is that the claim is false. Any such client is clearly buggy, and will be unable to survive in the marketplace: consider what happens if the client's routers briefly go down, or if the client's network is temporarily flooded.
In summary, an
NXDOMAIN response would be cached as specified in the
SOA of the applicable zone, whereas
SERVFAIL is unlikely to be cached, or, if cached, it'll be at most a double-digit number of seconds.