Why does a DNS query return NXDOMAIN? How negative caching works
After creating a DNS record, some queries can still return NXDOMAIN. A resolver may retain an earlier nonexistence response for a period determined from the SOA record.
You create a new subdomain or email record, but the query still returns NXDOMAIN. That does not always mean the record was entered incorrectly. DNS resolvers can retain an earlier “this name does not exist” response for a limited time. Understanding DNS NXDOMAIN negative caching helps you distinguish a record configuration issue from an older answer held in cache.
At a glance
- NXDOMAIN is the Name Error response that says the queried domain name does not exist in DNS.
- NODATA is different: the name is valid, but no record exists for the requested type.
- A negative response cache period is determined by the lower of the SOA MINIMUM field and the SOA record TTL.
- Even after you create a record, a resolver that previously received NXDOMAIN can use its cached negative response until its TTL reaches zero.
What does NXDOMAIN mean?
DNS arranges domain names in a tree structure. When a client queries a name, an authoritative DNS server can report that the name does not exist. This condition is response code 3, called Name Error or NXDOMAIN.
NXDOMAIN does not merely say that a requested record type is missing. It says that the queried domain name itself does not exist in DNS. This distinction matters when you are investigating the right problem. For a comparison of record roles, DNS records explained: A, CNAME, MX and TXT can help.
Because the DNS namespace is a tree, an NXDOMAIN response for a name also means that child names below it do not exist. Resolvers are expected to interpret cached nonexistence this way.
- NXDOMAIN: The queried name does not exist.
- Name Error: The DNS response-code description used for NXDOMAIN.
- Child name: A more specific name below the queried name.
Source: [6]
NXDOMAIN and NODATA are not the same response
Two DNS results that look similar can indicate different issues. NODATA is a term for a name that is valid for the relevant class but has no records of the requested type. For example, example.com can exist while not having the particular record type that was queried.
NXDOMAIN instead says that the name itself does not exist. First establish both the name and record type you queried. The result of an MX query and the result of an A query for the same name must be assessed separately because the record types differ.
- NODATA: The name is valid, but no record exists for the requested type.
- NXDOMAIN: The queried name does not exist.
- Check the query name and record type together to distinguish the issue.
Why does negative DNS caching exist?
Negative caching is the temporary storage by a resolver of DNS responses stating that a name does not exist or that no data exists for the requested type. When an authoritative name server returns NXDOMAIN or indicates no data for the requested type, it must include the zone’s SOA record in the authority section so the response can be cached.
An SOA is a record that carries authority information about a DNS zone. The cache period for a negative response is determined by the lower of the SOA record’s MINIMUM field and the SOA record’s own TTL. TTL is the lifetime that determines how long a cached response may be used.
This TTL decreases in the same way as a normal cached response. Once it reaches zero, the cached negative response must not be used again. As a result, an older NXDOMAIN result can continue at some resolvers after a new record is added, until the negative TTL expires.
- An authoritative server includes the SOA record in the authority section of a cacheable negative response.
- Negative TTL is determined by the lower of the SOA MINIMUM and SOA TTL values.
- When TTL reaches zero, the cached negative response is no longer used.
Source: [1]
Why might a newly created record not appear immediately?
Example scenario: you plan to create campaign.example.com in the example.com zone. If a resolver received NXDOMAIN for that name before the record was added, it can put that negative answer in its cache. Even if you later create the record on the authoritative DNS server, that resolver can use the cached response until the negative TTL ends.
The NXDOMAIN cache may affect more than the exact same name. Subsequent queries in the same class for names below the originally queried name can also be answered with the cached NXDOMAIN. This behavior relates to the position of the reported nonexistent name in the DNS tree.
For this reason, separate unsuccessful checks made before the subdomain was created from results obtained after the record was added. Recognizing that an authoritative answer and a cached answer are not necessarily the same makes a visibility delay easier to interpret.
- A previous NXDOMAIN can continue to be used until its TTL ends, even after a new record is added.
- A cached NXDOMAIN can also affect child-name queries in the same class.
- Consider the record creation time together with earlier unsuccessful queries.
Identify the nonexistent name in CNAME or DNAME chains
If a query follows a CNAME or DNAME chain, NXDOMAIN can refer to the nonexistent name at the end of the chain rather than the query name you originally entered. Checking only the initial name may therefore not be enough.
For example, if one name points to another and the final target does not exist, the cached NXDOMAIN is for that denied final name. Investigating the issue requires examining the final target in the chain as well.
- CNAME and DNAME can create DNS chains that point a query to another name.
- NXDOMAIN can apply to the nonexistent name at the end of the chain.
- A cached NXDOMAIN is not always for the original query name.
Source: [6]
How to check this in practice
Start by writing down the queried name and record type. Then distinguish whether the result is NXDOMAIN or NODATA for a valid name. These outcomes do not point to the same configuration issue.
Look for the SOA record in the authority section of a negative response. To assess how long the negative response may remain usable in cache, consider the lower of the SOA MINIMUM field and SOA TTL. Because TTL decreases, the value seen at the first observation can differ from a value seen later.
If the name was created recently, also consider whether NXDOMAIN queries were made earlier for that name or relevant child names. Where CNAME or DNAME is used, verify the final target in the chain separately. These checks help distinguish a missing record from a retained negative response.
- Verify the query name and record type.
- Distinguish NXDOMAIN from NODATA.
- Inspect the SOA record in the negative response.
- Consider the lower of the SOA MINIMUM and SOA TTL values.
- Check the final name in any CNAME or DNAME chain.
Practical checklist
- Confirm the domain name and record type you queried.
- Distinguish an NXDOMAIN result from NODATA.
- Check the SOA record in the authority section of a negative response.
- For negative TTL, consider the lower of the SOA MINIMUM and SOA TTL values.
- Allow for the cached negative response to be used until its TTL reaches zero.
- If you added a new subdomain, consider earlier NXDOMAIN queries and the effect on child names.
- If CNAME or DNAME is present, check the final target name in the chain.
NXDOMAIN says more than a requested record type is absent: it reports that the queried name does not exist. Negative DNS caching allows resolvers to reuse that response for a TTL based on the SOA record. When a new record is not visible, first distinguish NXDOMAIN from NODATA, then review the negative response’s SOA information and, where relevant, the final target in a name chain.
Frequently asked questions
Does NXDOMAIN only mean that an A record is missing?
No. NXDOMAIN says that the queried domain name does not exist in DNS. If the name exists but has no data for the requested record type, that is NODATA.
I added the new record. Why do I still see NXDOMAIN?
A resolver may be retaining a negative response received before the record was added. The negative TTL is determined by the lower of the SOA MINIMUM field and the SOA TTL, and it decreases until it reaches zero.
When I use CNAME, which name does NXDOMAIN indicate?
In a CNAME or DNAME chain, the nonexistent name can be the name at the end of the chain. The cached NXDOMAIN is for that denied final name, not always for the original query name.
Sources
[1] rfc2308.txt
[6] rfc8020.txt
