8

I'm reading through the following dns tutorial and it has this example in it:

domain.com.  IN SOA ns1.domain.com. admin.domain.com. (
                                        12083   ; serial number
                                        3h      ; refresh interval
                                        30m     ; retry interval
                                        3w      ; expiry period
                                        1h      ; negative TTL
)

The description for the negative TTL value says this:

1h: This is the amount of time that the name server will cache a name error if it cannot find the requested name in this file.

What are the conditions that could trigger the server to cache a name error like this? An example would be really helpful.

Improve this question

1 Answer 1

Reset to default
11

The negative caching interval in the SOA comes into play when an authoritative server indicated that the requested record did not exist. The specific cases are:

  • Replies with a response code of NXDOMAIN.
  • Replies with a NODATA synthetic state, but only forms where a SOA record is present. (NOERROR rcode, 0 answers, 1 SOA record in authority section + optional NS records)

It's common for server software to enforce a locally configured maximum on this value, so even if you have a negative TTL of 86400 the non-existence isn't necessarily going to be cached for that long by remote recursive servers.

The cases are covered by section RFC 2308 if you want to read further. Read section 2 as a primer, then 5-6.

Improve this answer
5
  • IIUC if I request "not.available.example.com" from the authoritative server then it gets cached for the negative time to live?
    – Ole
    Jan 7, 2017 at 22:04
  • Correct. Full recursive servers will reliably cache the non-existence, but behavior of stub resolvers (such as OS resolver libraries) will vary. Windows does, for example. You would find "Name does not exist." in the output of ipconfig /displaydns, which represents NXDOMAIN. You'll find instances of "No records of type X" in that output as well, which corresponds to NODATA. Most UNIX based systems do not, because they do not cache at all without additional configuration. (nscd with caching enabled, local recursive server and using 127.0.0.1 for DNS lookups, etc.)
    – Andrew B
    Jan 7, 2017 at 22:16
  • So if I'm imagining the purpose correctly, is it to be able to double check that "not.available.example.com" really was not available according to the full recursive server? In other words if I don't get an ip address, I can query the server at something like a /displaydns endpoint, and the result should contain confirmation that the address does indeed not exist?
    – Ole
    Jan 8, 2017 at 19:34
  • ipconfig /displaydns exists to tell you the contents of the local stub resolver cache. No more, no less. What admins might want to do with that info is open ended.
    – Andrew B
    Jan 8, 2017 at 20:15
  • @Ole The purpose is to prevent repeated queries for the name, once the server has already told the resolver that it doesn't exist. Just like any other caching.
    – Barmar
    Jan 10, 2017 at 18:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .