NXDOMAIN, no data, and negative caching

There are two ways DNS can say “no”, and they mean different things.

NXDOMAIN means the name you asked for does not exist. At all. No record of any type.

No data means the name exists, but it has no record of the type you asked for. Ask for AAAA on a name that only has an A record and you get no data.

Tell them apart

Let’s run both:

dig A missing.example.com
dig AAAA existing.example.com

The first shows status: NXDOMAIN. The second shows status: NOERROR with an empty answer section.

That NOERROR is the important clue. The name is real. It might have A, MX, or TXT records. It just doesn’t have AAAA.

This matters when you’re debugging. With no data, you know the name exists and can query other types. With NXDOMAIN, you’re looking for a typo or a missing record entirely.

Negative answers are cached

Resolvers remember “no” answers too. This is negative caching.

The authoritative server includes the zone’s SOA record in the authority section of a negative response. The SOA’s TTL and its last field tell the resolver how long to keep the negative result.

Here’s the practical consequence. Someone queries new.example.com before you’ve created it. Their resolver caches the NXDOMAIN. You create the record a minute later. That resolver keeps saying NXDOMAIN until the negative entry expires.

And no, setting a low TTL on the new record doesn’t help. The cached NXDOMAIN was stored before your record existed. It has its own timer.

Other failures are not “no”

SERVFAIL, REFUSED, and a timeout are different things. SERVFAIL often means broken DNSSEC or a broken authoritative server. REFUSED means policy. A timeout means the server didn’t answer at all.

None of these are negative answers. Lumping them all under “DNS propagation” throws away the evidence you need.

Check authority when a new name stays missing

When a record you just created still returns NXDOMAIN, compare a resolver with the source:

dig @1.1.1.1 A new.example.com
authoritative_server=$(dig NS example.com +short | head -n 1)
dig @"$authoritative_server" A new.example.com +norecurse

If authority returns the record and 1.1.1.1 returns NXDOMAIN with a shrinking TTL in the authority section, you’re waiting on negative caching. Wait it out or test through a different resolver.

If authority also returns NXDOMAIN, the record isn’t there. Fix the zone.

Try this: find one no-data case and one nonexistent name. For each, write down the status, the answer count, whether the SOA appears in the authority section, and the negative TTL.