Reuse a missing-name answer below its node

A missing node rules out its descendant names, not its siblings or parents.

• DNS is the Domain Name System. A client asks a resolver for a name and a record type; the resolver can query an authoritative server and cache the answer. NXDOMAIN is response code 3, meaning that the denied name does not exist. Names form a tree of labels: a.gone.example. is below gone.example., while other.example. is a sibling (§§1–2). The drawn descendants are hypothetical queried names, not records asserted to exist.
• When an iterative caching resolver receives NXDOMAIN, it SHOULD store it, consider names and resource record sets at or below the denied node unreachable, and answer subsequent queries there with NXDOMAIN (§2). This is a recommendation, not an unconditional MUST. A cut records nonexistence, not deletion of authoritative data.
• For a valid, unexpired cut at gone.example. in class IN, a later query for a.gone.example. can be answered locally without another authoritative-server request. The name error is independent of the requested record type. A and AAAA are types for IPv4 and IPv6 addresses; QCLASS is a separate DNS class (§§2,3.2).
• The same cut does not cover other.example., example., or notgone.example.; labels must match at the right end of the name, not merely as a text substring. A different QCLASS also does not match. Uncovered queries proceed through normal resolver processing, which could include other cached data; the illustration chooses an upstream lookup (§§2,3.2).
• The benefit is fewer unnecessary queries, including some repeated random-prefix traffic under a known nonexistent suffix. This is not complete denial-of-service protection. DNSSEC, expiry, aliases and existing cached data impose the conditions examined in the next chapters (§§2,4,7).