A recursive DNS resolver can continue returning an earlier absence result after the authoritative zone has gained the requested name. The new record and the cached negative answer are not contradictory: they exist at different points in the resolution path, and the cache remains valid until its negative TTL expires or local policy removes it sooner.
This behavior gives DNS absence its own cache lifetime. Publishing a record changes authoritative state, but it does not synchronously invalidate negative entries already stored by recursive resolvers.
Absence is cacheable state
DNS caching is not limited to positive resource records. RFC 2308 defines negative caching for responses that establish that a name does not exist or that a requested record type has no data at an existing name.
An NXDOMAIN response represents nonexistence of the queried domain name. A NOERROR response with no relevant answer can instead represent an existing name with no data for the requested type. Those cases carry different semantics even though both can leave an application without the address or record it requested.
A conforming negative response can include the zone’s SOA record in the authority section. The negative caching TTL is derived from the smaller of the SOA record’s TTL and the SOA MINIMUM field, subject to resolver behavior and later standards that apply to DNS processing.
The cached object is therefore an assertion about absence with a bounded lifetime, not merely a failed lookup that must always reach an authoritative server again.
Record creation does not recall cached answers
Suppose api.example.test does not exist and a recursive resolver receives a cacheable NXDOMAIN response with a negative lifetime of 300 seconds. Ten seconds later, the zone operator creates an A record for that name.
The authoritative server can answer new uncached queries with the new address immediately after the zone change is active on that server. The recursive resolver that cached the earlier negative result still has locally valid state, however. It can answer from that state without contacting the authority until the negative entry expires.
This produces an observable interval in which clients using different resolvers receive different answers. A resolver with no prior negative entry may see the new record, while another resolver continues reporting absence.
The interval is a direct consequence of cache semantics. DNS has no general mechanism by which an authoritative server pushes invalidation messages to every recursive resolver that previously queried a name.
Negative TTL controls a deployment boundary
A positive record TTL often receives attention before address changes because it limits the lifetime of cached old data. Negative TTL deserves the same treatment when a deployment introduces names that clients may query before publication.
If clients probe a future hostname while it is still absent, recursive resolvers can cache that absence. Creating the hostname moments later does not guarantee immediate visibility through those resolvers.
This matters for staged service activation, automated discovery, certificate validation flows, and any process that may query a name before its record exists. The exact impact depends on which DNS result is cached, the authoritative SOA values, recursive resolver policy, and the timing of queries.
Lowering a positive A or AAAA TTL does not by itself shorten a previously cached NXDOMAIN result. The negative lifetime comes from the negative response and its SOA-derived parameters rather than from a positive record that did not yet exist.
NXDOMAIN has a broader semantic scope than missing address data
An absent address record does not always mean the queried name is absent.
If a name exists with a TXT record but has no AAAA record, an IPv6 address query can receive a successful DNS response with no AAAA data. That state is distinct from NXDOMAIN, which states that the queried name itself does not exist.
The distinction affects caching and later changes. A negative answer tied to a missing record type describes a narrower absence than nonexistence of the entire name.
Resolvers also use DNS protocol rules when applying cached negative information to later queries. Treating every empty answer as interchangeable with NXDOMAIN discards information carried by the response code and authority data.
Application diagnostics that report only “DNS failed” can hide this boundary. The protocol result may distinguish nonexistent names, missing record types, temporary server failures, and other conditions that have different cache behavior.
SERVFAIL is not the same negative cache object
A lookup can fail without producing an authoritative statement of absence. SERVFAIL, timeouts, malformed responses, and transport failures do not mean that the queried name does not exist.
Resolvers can apply implementation-specific failure caching or retry controls, but those mechanisms should not be conflated with RFC 2308 negative caching of authoritative absence. The semantic source differs: one records a DNS assertion about missing data, while the other limits repeated work or reacts to an inability to obtain a usable answer.
That distinction matters during incident analysis. A client repeatedly seeing NXDOMAIN after record creation points toward cached absence or inconsistent authoritative data. Repeated SERVFAIL points toward a different class of resolution failure.
Authoritative consistency sets another limit
Negative caching is only one source of delayed visibility. A zone served by multiple authoritative servers can also expose inconsistent state while a change is propagating through the authoritative set.
A recursive resolver that queries an authority still serving old zone contents can receive a fresh negative response and cache it. In that case, the cache lifetime begins from an answer that was already stale relative to another authority.
The operational boundary therefore has two parts: authoritative servers must converge on the intended zone data, and recursive caches must age out earlier answers. Short cache lifetimes cannot compensate for an authoritative server that continues issuing obsolete responses indefinitely.
Cache flushing is local, not a protocol guarantee
Operators sometimes clear a local resolver cache during testing and then observe the new record. That confirms that cached state influenced that resolver, but it does not alter caches elsewhere.
Public recursive services, enterprise resolvers, operating-system caches, and application-local DNS layers can each have their own state and policy. A cache flush available on one machine is not a global invalidation operation.
Likewise, querying an authoritative server directly bypasses recursive cache state and can confirm publication without proving that ordinary clients already receive the same result.
The relevant observable is the answer along the client’s actual resolution path. Authoritative correctness and client-visible convergence are related properties, but they occur at different boundaries.
Publication order can avoid cached absence
When a new hostname is predictable, publishing its DNS record before clients begin querying it avoids creating negative cache entries for that name in the normal case. Service activation can then occur after the record has had time to become visible through recursive resolution.
This ordering does not eliminate every DNS failure mode, and it does not create a universal convergence guarantee. It changes one specific condition: resolvers are less likely to hold a still-valid assertion that the future service name does not exist.
Negative caching turns absence into durable distributed state for a limited interval. Record creation changes the authority’s present answer; expiration determines when earlier absence stops being reusable elsewhere.