Negative Caching of DNS Queries (DNS NCACHE)
updated by
- rfc-4033 — DNS Security Introduction and Requirements
- rfc-4034 — Resource Records for the DNS Security Extensions
- rfc-4035 — Protocol Modifications for the DNS Security Extensions
- rfc-6604 — xNAME RCODE and Status Bits Clarification
- rfc-8020 — NXDOMAIN: There Really Is Nothing Underneath
- rfc-8499 — DNS Terminology
- rfc-9499 — DNS Terminology
- rfc-9520 — Negative Caching of DNS Resolution Failures
updates
Extracted elements (28)
Authoritative servers are recommended to send only Type 2 NXDOMAIN responses (SOA in authority, no NS records) because many deployed resolvers incorrectly treat Type 1 NXDOMAIN (SOA + NS) as a referral, causing unnecessary queries to authoritative servers.
Negative cache TTLs should be capped (values of one to three hours have been found to work well; values exceeding one day have been found to be problematic), mirroring the MAXTTL concept pioneered in the CHIVES resolver to guard against excessively long TTLs.
Negative responses without SOA records SHOULD NOT be cached because without a TTL countdown, cached negative responses could loop indefinitely between misconfigured servers (e.g., two servers listing each other as forwarders).
The NODATA pseudo-RCODE was introduced in BIND 4.9.2 (1993) to distinguish 'name exists but no records of this type' from NXDOMAIN; it has no wire-format RCODE value and must be algorithmically inferred from the response contents.
The SOA MINIMUM field is redefined to mean solely the TTL for negative responses. Its two other historical meanings—minimum TTL of all RRs in a zone (deprecated, never used in practice) and default TTL for RRs lacking explicit TTLs (now handled by $TTL)—are retired.
A cached negative answer SHOULD include an implicit referral (NS records in the authority section) so that the resolver can locate an authoritative source. NXDOMAIN Types 1 and 4, and NODATA Type 1, provide this implicit referral.
Some name servers fail to set the RCODE to NXDOMAIN when CNAMEs are present in the answer section. If a definitive NXDOMAIN or NODATA answer is required, the resolver must re-query using the final QNAME.
Some resolvers incorrectly loop and eventually return SERVFAIL when the authoritative answer (AA) flag is not set in an NXDOMAIN response. Nameservers used as forwarders for such resolvers must force the AA flag on for NXDOMAIN responses; this is the default in BIND 4.9.3+.
Some resolvers treat a Type 1 NXDOMAIN response as a referral. To work around this, servers acting as forwarders to such resolvers must send only Type 2 NXDOMAIN responses.
A resolver MAY cache a server failure (SERVFAIL) response, but if it does so it MUST NOT cache it for longer than five minutes, and it MUST be cached against the specific query tuple <query name, type, class, server IP address>.
A server MAY cache a dead/unreachable server indication, but MUST NOT deem the server dead for longer than five minutes. The indication MUST be stored against <query name, type, class, server IP address> unless a transport-layer indication shows the server does not exist, in which case it applies to all queries to that IP.
If a containing zone is signed per RFC 2065, the SOA and appropriate NXT and SIG records MUST be added to negative responses.
If a NXT record was cached along with the SOA record it MUST be added to the authority section of the cached negative response; if a SIG record was cached with the NXT record it SHOULD be added.
Name servers authoritative for a zone MUST include the SOA record of the zone in the authority section when reporting an NXDOMAIN or indicating that no data of the requested type exists, so that the response may be cached.
Negative caching is no longer optional: if a resolver caches anything it must also cache negative answers. Non-authoritative negative answers MAY be cached.
Negative responses without SOA records SHOULD NOT be cached, as there is no TTL to prevent negative responses looping forever between a pair of servers.
The NXT record, if present in the authority section of a negative answer, MUST be stored so it can be returned with the SOA record. For NODATA responses the NXT record MUST have the same owner name as the query name.
The TTL of the SOA record included in a negative response is taken from the minimum of the SOA.MINIMUM field and the SOA's own TTL. Upon reaching zero, a cached negative answer MUST NOT be used again.
When a server answering a query encounters a cached negative response, it MUST add the cached SOA record to the authority section with the TTL decremented by the time it was stored in the cache.
A dead or unreachable server is one that fails to respond within 120 seconds or for which a transport-layer indication (ICMP unreachable, TCP reset) was received. The indication can be cached for up to 5 minutes.
A NODATA response with no SOA and no NS records in the authority section (Type 3) must be treated carefully: further queries may be needed to confirm NODATA with certainty, as the response may be ambiguous.
NODATA is a pseudo-RCODE (not an actual RCODE value) indicating the name is valid but no records of the queried type exist. It is inferred algorithmically from an NOERROR response with no relevant answers and an SOA or no NS records in the authority section.
NXDOMAIN (Name Error) is indicated by the NXDOMAIN RCODE and means the domain referred to by the QNAME does not exist. It is categorised into four types based on authority section contents: Type 1 (SOA + NS), Type 2 (SOA only), Type 3 (empty authority), Type 4 (NS only, no SOA).
QNAME is defined as the name in the query section of an answer, or, where CNAMEs are present, the data field of the last CNAME in the chain—i.e., the first CNAME value that does not resolve to another CNAME.
A NXDOMAIN injection attack can be mounted via a CNAME that causes a parent server to query an attacker-controlled server. Resolvers can mitigate this by re-querying the final QNAME while ignoring NS data received during the query.
DNS Security (RFC 2065) provides a mechanism to verify whether a negative response is valid through NXT and SIG records. This document promotes transmission of those security records even by non-security-aware servers.
Negative caching enables a denial-of-service attack by injecting a NXDOMAIN response with a very high TTL into a caching resolver or parent server, causing mail or other traffic to permanently fail rather than queue for retry. TTL sanity checking reduces this risk.
The $TTL directive is added to the DNS master file format. All resource records appearing after the directive that do not explicitly include a TTL have their TTL set to the value in the $TTL directive.