English
Why a New DNS Record Can Still Return NXDOMAIN
A new authoritative answer may coexist with an older recursive answer. Check the SOA and the client’s actual resolver.
IN THIS ARTICLE+
You create a hostname, check the authoritative server and see the new address. A customer still gets NXDOMAIN. Both answers can be accurate descriptions of what the responding servers know. A recursive resolver may be reusing an earlier negative response.
Distinguish absence of a name from absence of a type
NXDOMAIN means the queried name does not exist according to the answering DNS data. A successful response with no record of the requested type is a different result, often called NODATA. Query both the intended name and type. An existing IPv4 address does not imply an IPv6 record exists.
RFC 2308 describes how negative responses can be cached. The negative TTL is derived from the SOA information in the negative response, using the smaller of the SOA record TTL and its MINIMUM field. The TTL on the A record you just created cannot retroactively shorten an answer already stored in a resolver.
Compare authority and recursion
Query an authoritative server for the zone and then the recursive resolver used by the affected client. Record status, answer, authority section and time. Check more than one authoritative server when a zone change may be unevenly distributed. A recursive response with a decreasing negative TTL is consistent with a cached answer; inconsistent authoritative data requires a different fix.
Flushing a local browser or operating-system cache can be useful for diagnosis but cannot clear every upstream resolver. Switching to another public resolver may change the observation without repairing the original path.
Plan predictable changes
Create important names before clients begin querying them negatively. When a planned cutover involves existing records, adjust TTLs sufficiently ahead of time and account separately for negative caching. Declare success when the intended client population gets the correct answer, not just when a single authoritative lookup succeeds.
Further reading
IETF RFC 2308: Negative Caching of DNS Queries
Related guide: Move a Website Without Losing New Orders.
No comments yet. Share the first perspective.