DNS resolution and cache lifetimes

Exact cache and query evidence

Follow three queries through one resolver

The client asks for the same A record three times. The recursive resolver starts empty and can retain three different entries: a top-level delegation, a zone delegation and a positive or negative answer. The highlighted arrow comes from the current modeled message, not a decorative path. A usable answer avoids upstream queries. Without an answer, a usable zone delegation lets the resolver contact the authority directly. Otherwise it obtains the necessary referrals. All names, servers and addresses here are synthetic teaching fixtures; no DNS query leaves your browser.

Control cache lifetimes and logical time

Seconds between queries places requests at logical times zero, one gap and two gaps. Positive answer TTL controls the lifetime of an A answer. Delegation TTL controls both referral entries in this simplified exercise. Negative answer TTL controls the NXDOMAIN entry when Missing name is enabled. A cached entry is usable only while its expiry is strictly greater than the query time; equality means expired. Zero answer TTL permits the immediate response but prevents reuse by a later query, including another request at the same logical time. Editing any setting clears the scenario and rebuilds all three queries.

Distinguish an answer miss from a cold resolver

Keep the defaults: query gap ten seconds, positive TTL thirty seconds and delegation TTL one hundred twenty seconds. The first query contacts root, top-level server and authority; the next two are answer-cache hits. Set the gap to thirty: all three need an authoritative answer, but cached delegations mean the root and top-level server are each contacted only once. Set delegation TTL to thirty as well: each query is now a full walk because every relevant entry has expired at its next use. Compare the upstream query counts, not just the final returned address.

Test changed records and negative answers

Enable Change authoritative address before query two and set gap twenty with answer TTL thirty. Query one returns 198.51.100.10. Query two still returns that cached address at logical second twenty. Query three, at second forty, asks the authority again and receives 198.51.100.20. An authoritative change does not actively invalidate this resolver cache. Enable Missing name, use a ten-second gap and negative TTL fifteen: results are NXDOMAIN from the authority, NXDOMAIN from cache, then another authoritative NXDOMAIN. Authority unavailable instead returns SERVFAIL; this fixture deliberately does not cache that failure. It is not a claim about every resolver failure-caching policy.

Inspect messages without changing expiry

Play reveals the entire trace over sixty inspection seconds. Pause freezes inspection. Next message advances one recorded decision or message. Restart rewinds the same scenario; Restore defaults also resets its inputs. Speed changes viewing pace, Inspect time scrubs and Show final result exposes all three outcomes. The logical DNS clock is shown separately and advances only between query groups. Pausing or changing playback speed cannot age a cached record. Cache cards show stored time, expiry and remaining lifetime at the inspected logical time. The result list and expandable evidence repeat statuses, addresses, sources and exact query counts.

Keep the protocol boundary clear

Referral and glue entries share one configured lifetime here, and root hints are assumed available. Negative TTL is supplied directly rather than computed from an SOA record. Messages are ordered but have no modeled transmission delay, so query groups share one logical timestamp regardless of their number of messages. The model has only A queries, no CNAME chains, NODATA, DNSSEC, retries, alternate authorities, UDP truncation, TCP fallback, EDNS, cache eviction or serving stale answers. A zero-lifetime entry can remain visible as expired evidence until the next lookup removes it. Use the trace to reason about cache reuse and expiry, not to measure resolver latency or validate a production DNS implementation.

Protocol references: RFC 1034 and RFC 2308 negative caching.