negative caching ttl question

Tony Finch dot at
Tue Oct 13 17:34:46 UTC 2020

Veaceslav Revutchi <slavarevutchi at> wrote:

> Given this soa:
> 3600 IN SOA
> 1 7200 900 1209600 60
> I see bind caching negative answers for 3600 instead of 60. The rfc
> and my google searches suggest that it should pick the MIN(soa ttl,
> soa min ttl) for that purpose. What am I missing?

I think what RFC 2308 says (sections 3 and 5) the authoritative server for
the zone is responsible for calculating the negative TTL from the minimum
of the SOA TTL and MINIMUM fields. Sections 5 and 6 say that resolvers and
caches propagate the negative TTL using just the TTL field of the SOA in
the AUTHORITY section of the response (though the RFC could be a little
more explicit about this).

What's happening for is the AWS DNS authoritative servers are
setting the wrong TTL in the negative response, and your BIND cache is
doing what it is told to do.

f.anthony.n.finch  <dot at>
Ardnamurchan Point to Cape Wrath: Northeast 5 or 6, veering east 3 or 4 later.
Rough becoming moderate. Showers. Good, occasionally moderate.

More information about the bind-users mailing list