Summary

  • RFC 6762 lets an mDNS querier place records it already knows in the Answer Section of a query. A responder must remain silent when its matching record still shows at least half the correct TTL, but must refresh the querier once the stated lifetime falls below that threshold.
  • The carried record is explicitly non-authoritative. Other queriers must not cache it, because it expresses one host's time-bounded belief. A quiet responder therefore proves neither absence nor shared agreement; the query, TTL comparison and expiry path are the evidence.

A network printer appears in a browsing window without every printer announcing itself after every question. That economy can look like magic from the application. On the wire it is a carefully limited bargain.

The browsing host asks again because it may have missed a service, not because it wants duplicate copies of every record already in its cache. It therefore places the records it still knows into the Answer Section of the query. A printer whose matching record is listed may say nothing. Another printer not yet known still answers.

Silence is doing real work. It protects a shared local link from a response burst while allowing discovery to continue. Yet the packet format creates a dangerous temptation for an observer: the field is named Answer, so the records inside it can look like assertions. RFC 6762 refuses that inference. In a query, those records describe belief.

That distinction is the center of Stuart Cheshire's most interesting contribution to this mechanism. Cheshire is the first-listed of two authors of RFC 6762, with Marc Krochmal. The document is an IETF Standards Track specification, not an individual decree. Its precision comes from giving a cached belief enough effect to save capacity, then stopping that effect before it can become authority.

A local link without a central directory

Multicast DNS performs DNS-like operations on a local link without requiring a conventional unicast DNS server. Queries use UDP port 5353 and the link-local multicast addresses designated by the specification. Names ending in .local. have local-link meaning; the same string on another link is not automatically the same object.

The model replaces a single directory server with cooperating participants. Several devices can listen to one query. Several can hold Shared records with the same name, type and class. A service browser wants all relevant instances, not merely the device that answered first.

Continuous browsing therefore differs from a one-shot lookup. One response does not close the operation. Printers, speakers or other services may appear and disappear while the user keeps a window open. Naive constant polling would make a changing list current at the cost of repeated multicast traffic from every interested host and every responder.

RFC 6762 constrains that repetition. The first two continuous queries must be at least one second apart, later intervals must at least double, and Known-Answer Suppression is mandatory. Once an interval reaches an hour, the querier may hold the steady-state rate to one query per hour. A random initial delay reduces accidental synchronization.

These are not decorative timings. They distribute work among independent hosts without appointing a scheduler. The standard supplies a minimum common rhythm; the deployed devices decide when an application still has an active interest and whether another query is needed.

The answer inside the question

Known-Answer Suppression generally matters for Shared records. If a querier already has a Unique record, that record set ordinarily represents the complete answer and there is little reason to ask for another different one. A Shared record set can have additional valid members, so the host may need to ask again while declaring which members it already knows.

The responder performs a narrow comparison. If the answer it would send is already present in the query with a remaining RR TTL of at least half the correct value, it must not answer. The querier has enough lifetime left; another copy would spend capacity without improving its state.

If the remaining TTL is below half the true value known by the responder, the decision reverses. The responder must answer so the querier can refresh before the record approaches expiration. A querier should not include a record below half its original TTL in the known-answer list, because the record can no longer suppress a response and merely occupies packet space.

Half is not a confidence score. It does not mean the record is fifty per cent likely to be true. It is a timing boundary between two actions: conserve capacity now, or renew the cache before expiry becomes dangerous. The responder uses its current TTL as the reference, not the querier's confidence or a central clock.

This makes a packet trace auditable. The useful receipt contains the question, the known record, its stated remaining TTL, the responder's correct TTL, the shared-or-unique classification and the resulting decision. A log that records only response_count=0 discards the mechanism that made zero a valid outcome.

Belief may control traffic without becoming authority

RFC 6762 then draws its sharpest line. A querier must not cache resource records it sees in the known-answer section of someone else's query. The field is not authoritative. The sender says it believes the record remains true; it does not assert that the record is true.

The warning is practical. A cached record may have originated from a host that has left the network. Repeating that record into other caches would turn one stale observation into distributed stale state. The optimization is safe only because its effect remains local to the response decision addressed by that query.

This is a compact model of bounded participation. The querier contributes evidence to a shared decision: “you need not repeat this record to me yet.” It does not gain the right to speak for the service owner, to update neighboring caches or to settle a conflict. Participation changes traffic; it does not manufacture mandate.

Silence inherits the same limit. A responder that stays quiet may have seen an adequate known answer. It may also be absent, filtered, delayed or unable to hear the query. Without the packet and state around the gap, quiet is not a health result, an existence result or an authorization result.

When the belief list needs more than one packet

A busy browser may know too many records to fit in one query. RFC 6762 lets it set the TC bit, send the question with as many known answers as fit, then immediately follow with packets carrying the rest.

The responder waits a random 400 to 500 milliseconds after a TC-marked query. That pause gives the complete known-answer list time to arrive. If a later packet names an answer the responder planned to send, it removes that answer from its plan, unless another host has also asked for the record and is waiting.

The exception matters. One querier's cache cannot silence an answer needed by another. The shared link is not a private conversation, and the responder must preserve the interests visible in other questions.

Further TC-marked packets can extend the delay. The RFC acknowledges a theoretical case in which a continuous stream could postpone an answer indefinitely. It accepts delayed discovery as the less damaging error on a link already overloaded enough to produce that condition. Sending avoidable answers would add load exactly when capacity is most scarce.

This is a disclosed trade-off, not a guarantee of harmlessness. Operators still need delay, loss and volume evidence. The specification does not prove that a product implements the wait correctly or that a particular user experienced only a benign suppression interval.

Expiry is the exit from stale belief

The mechanism would be unsafe if cached belief never ended. RFC 6762 gives each resource record an RR TTL and tells a querier to remove the record after expiry.

When a local application still cares, the recommended maintenance sequence asks again near 80, 85, 90 and 95 per cent of the lifetime, with small random variation. A fresh response resets the TTL. If four queries bring no reply, the record is removed at 100 per cent.

The host must not maintain a record merely because it once learned it. If no local client has an active interest and expiry would change nothing visible, continued polling wastes the same capacity the suppression rule protects.

Refresh and deletion create reversibility. A service can stop answering; a cache cannot preserve it forever. A responder can remain quiet during the first half of useful lifetime, then becomes responsible for refreshing a still-interested querier. The querier can contribute its belief, but the clock limits how long that belief controls another host's behavior.

Running code decides whether the bargain survives

Apple's public mDNSResponder repository describes an active collection of daemons, tools and libraries for DNS Service Discovery. Its README says the daemon monitors multicast traffic on port 5353, resolves .local through mDNS and serves as the system resolver on macOS, with support for other platforms.

That is evidence of a living implementation surface, not proof of every deployed path. Product versions, vendor forks, wireless multicast handling, network segmentation and service-browser behavior can change the result. A normative MUST does not reach into a packet capture and make the comparison happen.

The operational test is therefore concrete. Does the query carry the expected known answers? Are their remaining TTLs correct? Does the responder refresh below half and stay quiet above it? Are TC sequences bounded? Does the cache delete the record at expiry? Does another waiting host still receive an answer?

This is where Running-Code Primacy becomes useful. The RFC defines the smallest interoperable rule. The implementation and local network produce the outcome. Neither an attractive service list nor a standards citation substitutes for the receipts between them.

Cheshire's documented role has the same boundary

RFC 6762 and its companion RFC 6763 list Stuart Cheshire first and Marc Krochmal second. That supports a clear statement: Cheshire participated substantially in the collective specification of Multicast DNS and DNS-Based Service Discovery.

His IETF Datatracker profile, reviewed on 30 August 2026, lists 28 RFCs and a current delegate role in the Congestion Control Working Group. Those details are dated because profiles and roles change. The RFC authorship remains documentary history; it still does not establish sole invention, ownership of Bonjour, control over Apple releases or responsibility for an operator's multicast domain.

The attribution discipline mirrors the protocol. A name on a standard is evidence of contribution. A known answer in a query is evidence of one host's cached state. Both become less useful when expanded into authority they do not carry.

The half-TTL rule gives belief a temporary power to produce silence. Its achievement is that the power expires before the belief can pretend to be truth.

Sources