A DNS response with no requested record does not always mean the same thing. NXDOMAIN says that the queried name does not exist; NODATA says that the name was queried but lacks data for the requested type. RFC 2308 gives these answers different cache keys and an SOA-based expiry. Check the response code, QNAME and QTYPE, the SOA in the authority section, and the remaining TTL together.

DNS concept diagram showing NXDOMAIN and NODATA cache keys and SOA-based expiry

NXDOMAIN and NODATA answer different questions

NXDOMAIN is a name-error RCODE: the name does not exist. NODATA is not a separate name-error code. It is generally inferred when the response is NOERROR but the answer section has no relevant record for the requested type. A name can have other record types while lacking the queried A record. Keep “the domain is absent” separate from “this name has no data of this type.”

RFC 2308 caches NXDOMAIN for the same name and class (QNAME, QCLASS), while NODATA is keyed by name, type, and class (QNAME, QTYPE, QCLASS). An A-query NODATA does not automatically answer an MX or AAAA query. Record both the name and query type when reproducing a recursive-resolver result.

The SOA carries a negative answer’s expiry

A negative answer has no answer-section record to carry a TTL, so the authoritative server normally includes the zone’s SOA in the authority section. RFC 2308 sets that SOA record’s TTL to the smaller of the SOA RR’s own TTL and SOA.MINIMUM. The value counts down in cache; at zero, the negative answer must not be reused. This does not mean SOA.MINIMUM is the TTL for every zone record.

Without an SOA, the reply may not follow the normal negative-caching path. RFC 2308 recommends against caching such a response because there is no expiry information to prevent forwarding loops. Inspect the RCODE, SOA owner zone, SOA TTL, MINIMUM, and the resolver’s remaining TTL.

Why an old answer can remain after adding a record

Adding data to authoritative DNS does not remove an NXDOMAIN or NODATA entry already held by a recursive resolver. The old answer may remain until its TTL expires. NXDOMAIN can be remembered for a name; NODATA includes the requested type in its key. A device stub, recursive service, and application may also keep separate caches with different expiry times.

For a read-only diagnosis, compare the authoritative reply, SOA and TTL, recursive RCODE and remaining TTL, and the exact name and type sent by the client. Do not infer that the zone must be changed again or that the TTL should immediately be lowered. First identify which layer still holds which answer. This is a diagnostic sequence, not an instruction to flush caches or change production settings.

SERVFAIL and timeouts do not mean a name is absent

RFC 9520 distinguishes NXDOMAIN and NOERROR/NODATA from resolution failures. SERVFAIL, REFUSED, timeouts, or unreachable servers may mean that no available server returned useful data. A resolver must implement a separate cache for resolution failures; RFC 9520 requires a duration of at least one second and no more than five minutes, and recommends backoff for persistent failures.

Do not read SERVFAIL as a cached “name does not exist” answer. Authoritative-server problems, DNSSEC validation, and network reachability can produce different failure conditions. Record the response code, retries, upstream server, name, and type to separate them.

Read BIND 9.20.2 as a version-specific policy

The ISC BIND 9.20.2 reference sets min-ncache-ttl’s default to zero seconds and truncates values above 90 seconds to 90. In this release, max-ncache-ttl defaults to 10,800 seconds (three hours) and has a seven-day ceiling. These values show that the SOA lifetime and a resolver’s local retention limit can both matter. Do not apply them to another BIND release or DNS implementation.

The same version documents servfail-ttl separately for DNSSEC validation failures or general server failures: its default is one second, its maximum is 30 seconds, and zero disables the cache. This product-specific range is distinct from RFC 9520’s five-minute general upper bound. The manual’s defaults also do not reveal a server’s live configuration.

Expert perspective: separate protocol expiry from implementation policy

RFC 2308 says when an SOA-based negative answer expires. RFC 9520 addresses caching a failure to obtain a useful answer so repeated queries do not worsen an outage. BIND 9.20.2 documents that release’s local retention bounds. Keeping those layers separate helps locate whether a stale answer comes from the authority response, resolver policy, or a server failure.

Sources

Read a fictional DNS response

These abbreviated examples assume an example. zone with no CNAMEs or delegations. They were created for explanation; they are not dig output from a live measurement. Compare status, ANSWER, and SOA across the three responses. Names and addresses are illustrative.

A. QUESTION: missing.example. IN A
   status: NXDOMAIN; ANSWER: 0
   AUTHORITY: example. 300 IN SOA ns.example. hostmaster.example.
              2026093001 3600 600 86400 300

B. QUESTION: www.example. IN AAAA
   status: NOERROR; ANSWER: 0
   AUTHORITY: example. 300 IN SOA ns.example. hostmaster.example.
              2026093001 3600 600 86400 300

C. QUESTION: www.example. IN A
   status: NOERROR; ANSWER: 1
   ANSWER: www.example. 600 IN A 192.0.2.10

Response meanings and cache keys

A reports NXDOMAIN: the queried name does not exist. The basic negative cache key uses the name and class. B illustrates NODATA: the name exists but the requested AAAA data does not. NODATA is not a separate RCODE; it is inferred from NOERROR and the response contents. Its cache key also includes the requested type. B does not establish that an A record is absent. C is a separate fictional response showing an A record for the same www.example. name.

Where 300 seconds comes from

Assume the zone’s original SOA TTL is 900 seconds and SOA MINIMUM is 300. The basic RFC 2308 calculation is min(900, 300) = 300 seconds. The SOA TTL carried in negative responses A and B is therefore already reduced to 300. Do not confuse SOA refresh, retry, or expire with that TTL. In a fictional cached response after 120 seconds, the remaining SOA TTL is 180. Resolver limits, policy, and additional specifications may affect real behavior; these numbers are not an operational guarantee.

A comparison checklist after a change

  • Distinguish authoritative-server replies from your recursive resolver’s replies.
  • Keep query name, type, and class the same when comparing.
  • Inspect answers and the authority SOA as well as status. An empty NOERROR answer alone does not justify ignoring referrals or CNAMEs and calling it NODATA.
  • Check whether the remaining TTL decreases. Creating a record does not necessarily remove an already cached negative response immediately.

Source: RFC 2308 §2.2, §3, §5, §6: NODATA interpretation, SOA TTL calculation, cache keys, and remaining TTL. The response fields and numbers are original fictional examples, not copied operational logs.