The missing-name answer that gets remembered

Suppose someone tries to open new.example.com before its DNS record exists. The DNS resolver they use asks for the hostname and receives an answer saying it does not exist. Later, you add the record, but the same person still gets an error. The record may be correct: their resolver can temporarily reuse the earlier answer instead of asking again.

This is negative DNS caching. A positive cache entry remembers a record, such as an IP address. A negative cache entry remembers that a requested name or record was not found. Caching both kinds of answers reduces repeated DNS queries, but it can make a newly created hostname seem slow to appear.

NXDOMAIN and missing record types are different

An NXDOMAIN response means the queried name does not exist in that DNS zone. If new.example.com had no records when it was first queried, a resolver might cache that response. Creating an A or AAAA record afterward will not necessarily change what that resolver returns until its negative cache entry expires.

A hostname can also exist while lacking the particular record type requested. For example, it might have an A record but no AAAA record. A resolver can cache the answer that no record of the requested type is available. When troubleshooting, note both the exact hostname and the record type: a successful A lookup does not prove an AAAA lookup will succeed.

Negative answers are generally cached for a limited period based on information supplied in the DNS response, commonly associated with the zone’s SOA record. Resolver policies can affect the period as well. That is why one network may see your new record before another does.

Check the source before blaming a cache

First, confirm the record was added to the intended DNS zone. In a DNS management panel, check the full hostname, record type and value. A label entered in the wrong zone can create a different name than you expected. Also confirm that the domain’s delegation points to the nameservers where you made the change; editing a zone that is not serving the domain will not fix public lookups.

Next, compare an answer from an authoritative nameserver for the domain with one from your usual recursive resolver. If the authoritative server returns the new record but the recursive resolver still reports that it is missing, caching is a plausible explanation. If the authoritative server also reports it missing, revisit the record and delegation before waiting.

Be precise about the failure you observe. A browser message can reflect DNS, but it can also result from a connection or website configuration problem. If DNS returns the expected address and the site still does not load, check the web service and its configuration rather than treating every failure as a DNS cache issue.

What to do while a negative answer expires

If the authoritative answer is correct, allow time for cached negative answers to expire. Repeatedly saving the same record will not force other people’s resolvers to discard what they already cached. You can retry through a different resolver or network to help distinguish a local cached answer from a broader configuration problem, but a different result does not guarantee that every visitor will see it yet.

A device or browser may also retain DNS-related information locally. Clearing a local cache or restarting an application may help with a test on your own device, although it cannot clear a cache held by an external resolver. Keep test results labeled by hostname, record type, resolver and time so you can tell whether an answer has changed instead of comparing unlike queries.

Plan new hostnames to avoid the surprise

When preparing a hostname you know people will soon use, create its DNS record before sharing the address or configuring software that will query it. This reduces the chance that early requests generate negative answers. For a planned change to an existing record, a lower positive TTL set in advance may help with old addresses, but it does not erase an NXDOMAIN answer already cached for a previously nonexistent name.

Negative caching is usually temporary, not evidence that DNS is permanently broken. The useful sequence is to verify the authoritative answer, compare it with a recursive answer, then wait if the difference is consistent with caching. If the authoritative answer is wrong, fix the underlying DNS setup first.

Back to category ↗