Summary

  • DNS learned to scale misses by caching bounded statements of absence. NXDOMAIN says a name does not exist; NODATA says the name may exist but lacks the requested record type. Confusing them suppresses information that is actually present.
  • RFC 2308 made the SOA record carry the negative answer’s lifetime. The smaller of the SOA TTL and MINIMUM counts down in every cached reply; at zero the denial must be discarded. Without that portable countdown, forwarding loops could keep a false negative alive forever.
  • DNSSEC later made denial cryptographically verifiable and reusable across ranges. That reduces authoritative load but enlarges the effect of one statement. A signature proves origin and integrity under DNS, not that an institution ought to be absent or that an outage is nonexistence.

Silence cannot be cached safely

A resolver asks for an address and receives no useful answer. That observation alone is ambiguous. The name may not exist. The name may exist without an A record. The server may be unreachable, misconfigured or temporarily unable to answer. A referral may be telling the resolver where to continue. Silence has no owner, scope or safe lifetime.

Repeated ambiguity is expensive. Search lists, mistyped names, automated discovery and unavailable services can send the same losing query toward authoritative infrastructure again and again. Positive caching does not help: there is no positive resource record to store.

The 1987 DNS design in RFC 1034 already described negative response caching, but as an optional service. An authoritative name error could be associated with a TTL and remembered. This fitted the system’s broader tradeoff: distribution and local caching made global naming affordable, while the data source influenced the balance between update speed and cached accuracy.

Yet the first settlement was incomplete. As RFC 2308 later explained, RFC 1034 did not let a server hand a cached negative to another resolver in a form that preserved the same useful evidence. The network could remember “no,” but it had not fully standardised how that memory travelled.

Two kinds of nothing

The first discipline is to say what is absent. NXDOMAIN is a Name Error response. It states that the domain name identified by the effective query name does not exist. A cache therefore keys it by name and class. Asking for another record type does not revive a name already known not to exist.

NODATA is narrower and more awkward. It has no dedicated response code. The header says NOERROR, the relevant answer is empty, and the authority section must let a resolver distinguish the response from a referral. The name can exist—perhaps with MX, TXT or AAAA records—while the requested A record does not.

For that reason, NODATA is cached by name, type and class. A negative for A must not erase an existing MX. The distinction is not taxonomic elegance; it prevents a cache optimisation from becoming data loss.

CNAME chains make the scope more delicate. A response may prove that the canonical target does not exist even though the alias in the original question does. The evidence applies to the name actually denied, not whichever label is most convenient to store.

Giving “no” an authoritative clock

RFC 2308, published in March 1998, was authored by Mark Andrews while at CSIRO, placing an Australian public research institution directly in the documentary lineage of this operational DNS rule. The IETF supplied the standards venue through which the contract and later DNSSEC refinements became shared Internet specifications. The institutional roles are distinct: CSIRO is linked here because it is the author affiliation recorded on the decisive specification, while the IETF process turned the text into a common Internet contract.

An authoritative server reporting NXDOMAIN or NODATA must include the containing zone’s SOA record in the authority section. The SOA identifies the zone that can speak for this absence and carries the timing material needed to limit it.

The negative TTL is the smaller of two numbers: the SOA record’s own TTL and its MINIMUM field. A cache stores the SOA with the denial. When it answers another client, the TTL is reduced by the time already spent in cache. Once it reaches zero, the negative must not be used again.

This countdown changes the meaning of a cached error. It is not a timeless conclusion that a name cannot exist. It is a lease on an authoritative statement: for this scope, the zone recently said no; after this interval, ask again.

RFC 1035 had originally defined SOA MINIMUM as a lower bound for TTLs exported from a zone. Practice overloaded the field as a general minimum, a default for omitted TTLs and a negative-cache lifetime. RFC 2308 deprecated the first meaning, introduced $TTL for zone-file defaults and retained MINIMUM as an input to negative lifetime. Implementation experience repaired the semantics of a field that deployment had already repurposed.

The error that could circulate forever

Why must the SOA and its decreasing TTL accompany the cached denial? Because DNS forwarding can form a graph even though the namespace is a tree. Two misconfigured servers may list each other as forwarders. Lame delegations can create other query loops.

If a negative response arrives without a portable countdown, each server may cache it briefly and then send it onward with a newly reset lifetime. The indication can circulate indefinitely. RFC 2308 therefore says negative responses without SOA should not be cached: even a short local TTL cannot guarantee expiry if every hop restarts it.

The rule exposes a general property of distributed evidence. A limit that is not preserved across transmission is not a limit. The SOA does more than decorate an error; it lets independent caches carry the same declining authority boundary.

Running code before a clean standard

RFC 2308 includes a deliberately modest implementation history. Paul Vixie recalled that the late-1987 CHIVES resolver cached authoritative errors using SOA MINIMUM, keyed to the exact query. Search paths generated heavy repeated misses, and ARPANET congestion made avoiding needless queries operationally valuable. The few machines running CHIVES saw markedly better DNS response time, but this is not a census of the Internet.

The appendix also records BIND 4.9.2 ALPHA work in July 1993. Early code used a ten-minute negative TTL and stored whether the result was NXDOMAIN or NOERROR_NODATA; later work retained the SOA so that cached negatives could be returned with their evidence.

No single implementation invented the whole settlement. The standard absorbed lessons from running resolvers: precise keys, a portable SOA, declining TTLs and compatibility with software that misread certain authority sections. The history is one of operational feedback tightening a common contract.

Efficiency bought with delayed creation

Negative caching can remove a large class of repeated DNS traffic and return misses quickly. It can also hide a repair. If an operator creates a name or adds a previously missing record while resolvers still hold a negative answer, those resolvers continue to say no until their TTL expires.

RFC 2308 notes that the protocol’s numeric range could represent decades, but sensible resolver limits are far shorter. It reports one to three hours as workable defaults and values beyond a day as troublesome. The source defines an upper lifetime; a resolver may impose a smaller local cap.

Different caches receive the denial at different times. Expiry is therefore not a global instant. A rollback plan must account for which recursive resolvers observed which negative, when they stored it and whether local policy shortened the published interval.

The same precision matters during failure. SERVFAIL, timeout and unreachable server do not prove that a name is absent. RFC 2308 gives some of these conditions separate optional, short caching rules. Turning an outage into NXDOMAIN may cause applications to make irreversible decisions. The RFC notes that mail can bounce immediately on an injected NXDOMAIN while a bad address may leave it queued long enough for recovery.

From remembered denial to verified range

DNSSEC changed what a resolver could prove. RFC 4034 defined NSEC records that link existing names in canonical order and list the record types present at an owner. RFC 4035 supplied validation rules for authenticated denial. A signed chain can demonstrate that no exact owner lies in a particular interval or that an existing owner lacks a type.

NSEC also made zone contents easier to enumerate. RFC 5155 introduced NSEC3, using hashed owner names and an Opt-Out mode. Opt-Out is a boundary: a covering NSEC3 record does not necessarily prove that every possible name beneath it is absent.

These mechanisms authenticate DNS evidence; they do not make absence morally or institutionally correct. A compromised but validly signing zone can publish a destructive denial. A correctly validated negative can still be operationally stale.

RFC 8020 later allowed an NXDOMAIN at a node to cut off queries below that node: if a name does not exist, names beneath it cannot exist in the DNS tree. The rule applies to NXDOMAIN, not to NODATA; an existing name without one record type may have descendants and other types.

RFC 8198 went further for validating caches. With sufficient NSEC or NSEC3 evidence already stored, a resolver can synthesize NXDOMAIN or NODATA for another query in the covered range without contacting an authoritative server. One signed denial becomes reusable evidence, not merely one cached answer.

The efficiency is real: lower latency, fewer packets and less state at authoritative systems. So is the transition cost. RFC 8198 stresses that a name newly added inside a negatively covered range may remain unseen until the relevant TTL expires. The SOA and denial-record lifetimes become a statement about how quickly creation can take effect.

A finite claim, not a throne

Negative caching separates four roles. The zone operator publishes what exists and sets the lifetime of denials. The authoritative server attaches the zone’s evidence. The recursive resolver validates, scopes and ages it under local limits. The application decides what a negative response means for mail, login, discovery or recovery.

Collapsing those roles turns an optimisation into authority. The ability to publish NXDOMAIN is power over reachability. The ability to validate it is power to reject forged evidence. The ability to cache it is power to amplify one answer across clients. None alone proves who deserves a name or whether an institution exists outside DNS.

The durable achievement was narrower. DNS made nonexistence operationally reusable by attaching a subject, a kind of absence, an accountable zone and a countdown. The error learned to expire, and because it expired, distributed systems could afford to remember it.

Sources and evidence limits

The original DNS design and SOA field semantics come from RFC 1034 and RFC 1035, with RRset clarification in RFC 2181. The mandatory negative-cache contract, NXDOMAIN/NODATA distinction, SOA countdown, loop warning and implementation appendix are in RFC 2308.

Authenticated denial records and their validation are defined by RFC 4034 and RFC 4035. Hashed denial and Opt-Out limits come from RFC 5155. The later subtree interpretation is RFC 8020, and validated range synthesis is RFC 8198.

The implementation history in RFC 2308 is a retrospective account embedded in the standard, not a complete deployment survey. Later DNSSEC behaviour is used to show expansion of the evidence model and is not attributed to early resolvers.