Negative Caching (RFC 2308)

A correct resolver caches the absence of a record, not just the presence. Otherwise:

• not.a.real.host.example.com → root → .com → example.com → NXDOMAIN
• Repeat 10× per second and you flood the authoritative server.

RFC 2308 mandates negative caching of NXDOMAIN and NODATA answers.

The two flavours

Both must be cached. Without negative caching, NODATA can be even more abusive — clients often retry several QTYPEs (A, AAAA, HTTPS) per name.

The TTL — SOA MINIMUM

The negative TTL is set by the MINIMUM field of the SOA record for the zone (RFC 2308 §5):

neg_ttl = min(SOA.minimum, SOA.TTL)

Typical SOA minimum values:

• 300 (5 min) — modern recommendation; lets typo'd domains recover quickly.
• 3600 (1 hour) — common older default.
• 86400 (1 day) — too long; punishes users when an admin creates a record.

Implementation rules

• Cache key: (name, type) — distinct from positive cache.
• On a negative hit during the TTL window: return immediately without querying authoritative.
• On expiry: discard and re-query.
• Apex zone: longest-matching zone wins. For x.sub.example.com, prefer sub.example.com's SOA over example.com's.

Why it matters

Without negative caching, a single misspelled URL on a busy CDN can DDOS root nameservers. The DITL ("Day in the Life of the Internet") project routinely measures this — junk queries make up 30–50% of root traffic.