Negative Caching and NXDOMAIN: How Failed Lookups Get Cached

Negative caching means resolvers remember when a name does not exist (an NXDOMAIN answer), so they can answer future lookups for it without asking again — and this is why a newly created record can seem slow to appear. It is a normal, useful part of DNS that surprises people at exactly the wrong moment.

What NXDOMAIN means

When you query a name that does not exist, the authoritative server returns NXDOMAIN — "this name does not exist". You will see this status in dig output. It is a definitive negative answer, not an error.

Why negatives get cached

Just as positive answers are cached to reduce load, negative answers are cached too — otherwise every lookup for a non-existent name (typos, probes, misconfigurations) would hit the authoritative servers repeatedly. Caching the "no" protects your nameservers from wasted queries.

How long a negative is cached

The duration is controlled by the minimum field of the zone's SOA record, which today specifically sets the negative-caching TTL. If that value is an hour, an NXDOMAIN can be cached for up to an hour.

The classic gotcha

Here is where it bites: you query new.example.com before creating it, getting NXDOMAIN. That negative is now cached. You then create the record — but for the length of the negative-cache TTL, resolvers that already cached the "no" keep returning NXDOMAIN, so your new record appears not to work. Nothing is broken; the negative cache simply has not expired.

How to avoid the surprise

• Create the record first, then test — don't query a name before it exists, or you seed a negative cache entry.
• Keep the SOA minimum sensible — a very long negative TTL prolongs this effect.
• Check the authoritative server directly — querying your nameserver shows the record exists immediately, even while resolvers still hold the cached NXDOMAIN. This relates to how propagation works.

Frequently asked questions

Why does my new DNS record return NXDOMAIN?

Likely because the name was queried before you created it, so resolvers cached the "does not exist" answer. Once the negative-cache TTL (the SOA minimum) expires, they will fetch the new record. Querying the authoritative server directly confirms it already exists.

What controls how long NXDOMAIN is cached?

The minimum field of the zone's SOA record, which now defines the negative-caching TTL. Lowering it shortens how long non-existence is remembered, at the cost of slightly more queries for missing names.

Is NXDOMAIN an error?

No — it is a valid, definitive answer meaning the name does not exist. It is different from SERVFAIL, which indicates the resolver actually failed to get an answer. NXDOMAIN is a clear "no".