DNS caches are not limited to successful address lookups. A recursive resolver can also retain an authoritative answer that says a requested name does not exist or that a particular record type has no data.
This behavior is called negative caching. It prevents repeated requests for the same missing data from reaching authoritative DNS servers on every lookup.
Negative answers cover different cases
A DNS response can report that an entire domain name does not exist. The NXDOMAIN response code represents this case.
A different case occurs when the name exists but has no record of the requested type. A host might have an AAAA record but no A record, for example. The response can indicate success at the protocol level while returning no matching answer records.
Resolvers can cache both forms of negative information when the response contains the authoritative data needed to establish a cache lifetime.
The SOA record supplies timing information
Authoritative negative responses commonly include the zone’s Start of Authority, or SOA, record in the authority section. The SOA carries fields associated with the zone, including a minimum value used in calculating the negative cache lifetime.
For negative caching defined by modern DNS rules, the effective TTL is based on the smaller of the SOA record’s TTL and the SOA minimum field. A resolver can reduce the remaining TTL as time passes, just as it does for positive cached records.
The result is temporary reuse rather than a permanent statement that a name or record is absent.
Reusing a negative result cuts repeated DNS traffic
Missing names can be queried surprisingly often. A mistyped hostname, stale application configuration, service-discovery probe, or repeated request for an unavailable record type can trigger the same lookup many times.
Without negative caching, each attempt can cause a recursive resolver to contact authoritative infrastructure again. Retaining the negative result lets the resolver answer matching requests locally until the cached entry expires.
This reduces latency for repeated misses and avoids unnecessary work for recursive and authoritative servers.
Expiry allows new DNS data to become visible
A cached negative answer can briefly hide a record created after the negative response was stored. If a resolver has an unexpired entry stating that a name does not exist, adding that name to the authoritative zone does not force the resolver to discard its cached result immediately.
The resolver can continue returning the negative answer until its cache lifetime ends. A later query can then obtain the newly published data.
This makes negative TTL policy relevant during DNS changes. Long negative lifetimes reduce repeated traffic but can extend the interval before newly created names or record types become visible through resolvers that cached an earlier miss.
Negative caching differs from local failure caching
Not every failed DNS lookup is an authoritative statement about missing data. Timeouts, unreachable servers, malformed replies, and transient server failures represent different conditions.
Resolvers may apply separate retry or failure-handling policies to those events. Such behavior should not be treated as equivalent to an authoritative NXDOMAIN response or an authoritative answer showing that a requested record type is absent.
The distinction matters because negative caching relies on DNS information that describes the namespace, while transport and server failures describe trouble obtaining an answer.
DNSSEC can authenticate absence
In DNSSEC-signed zones, denial-of-existence records can provide cryptographic evidence that a requested name or record type is absent. Records such as NSEC and NSEC3 support that function.
DNSSEC validation and negative caching solve related but separate problems. Validation can establish that authenticated zone data supports the negative answer. Caching determines how long a resolver can reuse that answer without repeating the resolution process.
A resolver still applies cache lifetime rules rather than treating authenticated absence as permanent.
Negative entries are temporary DNS state
Negative caching turns authoritative absence into reusable resolver state. It can suppress repeated queries for nonexistent names and missing record types, lowering DNS traffic and returning repeated misses quickly.
Its expiry behavior is equally important. Once the negative cache lifetime ends, the resolver can query again and observe records that have appeared since the earlier response.
That balance lets DNS avoid needless repeated work without converting a temporary cached absence into an indefinite result.