Why Does DNS Still Show an Old Result After a Change? Separating TTL from Negative Caching
After a DNS change, the result may be an old record value, NXDOMAIN, or NODATA. Learn what each response means and why it may remain cached.
You changed a DNS record or added a new subdomain, but a query still shows the old destination or returns a “not found” result. These outcomes can look similar, but they do not have the same cause. Separating DNS TTL and negative caching helps you interpret why the expected answer is not visible yet. In DNS, a resolver is a program that obtains information from name servers in response to client requests. Name servers can hold information about part of the domain tree and can use a cache. For that reason, begin by identifying what the result actually says: are you seeing an earlier existing value, or an earlier answer saying that something did not exist?
At a glance
- If an old IP address or another existing value appears, normal caching of a DNS answer may be involved.
- NXDOMAIN means the queried domain name does not exist; NODATA means the name is valid but the requested record type is absent.
- Negative answers also have a TTL. It is determined by the lower of the SOA TTL and SOA.MINIMUM.
- For diagnosis, first distinguish an old value from NXDOMAIN and NODATA.
Classify the result before diagnosing it
After a record change, an “old result” can describe two different situations. In the first, the response still contains an earlier value for an existing record. For example, an A record may still return its previous destination. This concerns cached knowledge that a record has a particular value.
In the second, the response says that the requested information does not exist. Negative caching is the storage of knowledge that a record or domain name does not exist. Treating an old value and an absence response as the same symptom does not produce a clear diagnosis.
If you need to review what record types represent, the article DNS records explained: A, CNAME, MX and TXT can help clarify the record type you are querying.
- Old value in the answer: examine normal caching of existing data.
- NXDOMAIN: examine a negative answer stating that the queried domain name does not exist.
- Valid name but no requested type: examine the NODATA case.
NXDOMAIN and NODATA are not the same
NXDOMAIN is another expression for the Name Error RCODE. It means that the domain referred to by the QNAME, the queried domain name, does not exist. As an example scenario, consider a query for new.example.com before that name has been created. An NXDOMAIN response is broader than the absence of one type such as A, MX, or TXT beneath an existing name.
NODATA means that the name is valid for the relevant class, but there are no records of the requested type. There is no separate RCODE value for NODATA; it is inferred from the response contents. In an example scenario, mail.example.com can be a valid name while no record of the requested type exists at that time. Therefore, keep “the domain name does not exist” separate from “this record type does not exist.”
The distinction matters because negative answers use different cache keys. An NXDOMAIN answer can be cached for another query with the same QNAME and QCLASS. A NODATA answer can be cached for the same combination of QNAME, QTYPE, and QCLASS. QTYPE is the requested record type, while QCLASS is the class in the DNS query.
- NXDOMAIN: the domain name identified by the QNAME does not exist.
- NODATA: the name is valid, but data for the queried record type is absent.
- NXDOMAIN caching is associated with QNAME and QCLASS; NODATA caching is associated with QNAME, QTYPE, and QCLASS.
Source: [2]
Where does a negative answer’s TTL come from?
TTL is the lifetime that indicates how long DNS information can be used from a cache. Negative answers also have a TTL. Because a negative answer has no answer-section record to which that TTL can be applied, name servers authoritative for a zone must include the zone’s SOA record in the authority section when reporting NXDOMAIN or indicating that data of the requested type does not exist.
The TTL for a negative answer is the lower of the SOA record’s MINIMUM field and the TTL of the SOA record itself. This indicates how long a resolver may cache the negative answer. Like a normal cached answer, the negative TTL decreases. Once it reaches zero, the cached negative answer must not be used again.
Accordingly, seeing NXDOMAIN or NODATA after creating a new name or record can be consistent with a previously cached absence response. By contrast, if you see an old destination value, examine normal caching of existing data rather than negative caching.
- Name servers authoritative for a zone must include the SOA record in the authority section for NXDOMAIN or no-data-for-the-requested-type responses.
- The negative TTL is the lower of SOA.MINIMUM and the SOA TTL.
- When the negative TTL reaches zero, the cached negative answer must not be used again.
Source: [2]
A comparative diagnostic flow
First, identify the answer for the name and record type you changed. If you see an old value, an existing value is still being returned. If you see NXDOMAIN, there is an answer saying that the queried name does not exist. If you see NODATA, the name is valid but the requested type is absent. Grouping all three under one label such as “DNS propagation” hides the nature of the result.
Second, separate the roles of the components returning information. A resolver gathers information in response to a client request; a name server may hold authoritative information or use cached information. This distinction helps when assessing why different query paths need to be considered after the same change. You can assess this alongside Why Can a DNS Answer Look Different on Different Networks? Authoritative Servers and Caches.
Third, apply negative TTL logic only when the answer is negative. If the result is NXDOMAIN or NODATA, assess the negative TTL carried through the SOA. Before the TTL reaches zero, a resolver may use its stored negative result. Once it reaches zero, that negative response must not be used again. This framework separates the existence of a new record from an earlier cached statement of absence.
- Old value: assess normal caching of existing data.
- NXDOMAIN: assess whether knowledge that the domain name does not exist was negatively cached.
- NODATA: assess the negative answer that the name exists but the requested type is absent.
- Only for a negative result: assess whether the SOA-derived TTL has reached zero.
Practical checklist
- Write down the domain name and record type you queried.
- Determine whether the response is an old value, NXDOMAIN, or NODATA.
- For NXDOMAIN, assess the conclusion that the queried QNAME does not exist.
- For NODATA, assess whether the name is valid but the requested record type is absent.
- For a negative answer, review the SOA record that name servers authoritative for the zone must include in the authority section and review the negative TTL logic.
- Take into account that a negative answer must not be reused after its TTL reaches zero.
- Keep the resolver’s role separate from the role of a name server holding authoritative information.
Not every old DNS result means the same thing. An old record value is cached existing information; NXDOMAIN says the domain name does not exist, while NODATA says the name is valid but the requested type has no data. Because negative answers have a TTL based on the SOA record, starting by naming the response type is the safest diagnostic approach.
Frequently asked questions
Does NXDOMAIN mean that an A record is missing?
No. NXDOMAIN says that the domain referred to by the queried QNAME does not exist. If the name is valid but only the A record is absent, that is a NODATA case.
Is there a separate DNS error code for NODATA?
No. NODATA is not a separate RCODE. It is inferred from the response contents and means that the name is valid but the requested record type is absent.
When must a cached negative answer stop being used?
The TTL of a negative answer decreases in a similar way to a normal cached answer. When the TTL reaches zero, that cached negative answer must not be used again.
Sources
[1] rfc1034.txt
[2] rfc2308.txt
