Visual RFC.
ALL RFCs / RFC 8020
Read the RFC ↗
RFC 8020 / NXDOMAIN CUT

Separate a missing name from missing data

02

An existing name without a requested record type is different from a name that does not exist.

RFC 8020 · § 3.1EXAMPLE
4 / 4
Separate a missing name from missing dataA server would be wrong to call an empty non-terminal nonexistent when its child has data. The invalid classification is stopped before installing a cut.Missing name or missing data?leaf.branch.example. has real databranch.example. therefore existsWrong ENT → NXDOMAIN inferenceStop before storing this erroneous cutNo new mandatory DNS error is inventedRFC8020 · chapter 2 · state 4 · fictional examples
04
Stop the incorrect inference

The failed classification would hide a real child; the illustration stops before a new cut is stored.

Source for this drawing: RFC 8020 · Read RFC section 3.1 ↗

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
New to this? Start hereA quick picture + helpful background

A message needs an address.

Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.

Helpful first, if these ideas are unfamiliar

These pictures are analogies to help you learn. The linked RFC explains the actual rules.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

KEY POINT

NODATA does not create an NXDOMAIN cut.

  • A resource record set (RRset) groups records of one type at a name. An empty non-terminal (ENT) is an existing name with no RRsets of its own but with descendants that have data. For example, leaf.branch.example. can have an A record while branch.example. itself has none. The intermediate branch still exists (§3.1; RFC 4592 §§2.2.2–2.2.3).
  • For the selected ENT query, the correct result is NODATA: response code NOERROR (0) and an empty answer section. It is not NXDOMAIN. Here no alias is involved. NODATA is a description of the result, not a separate numeric DNS response code (§3.1).
  • An ordinary existing host can likewise lack AAAA while having A records. A negative cache entry for missing data is scoped to name, requested type and class; an AAAA miss must not be turned into absence of the name or its A records (RFC 2308 §5, contrasted with RFC 8020 §3.2).
  • Authoritative servers returning NXDOMAIN for an ENT are incorrect; RFC 8020 §5 explains how this can wrongly hide existing descendants and is incompatible with DNSSEC. The failed classification is stopped before creating a cut in this teaching scene. It is not a new RFC-mandated error response or a guarantee that every resolver repairs a bad answer.
  • This publication clarifies RFC 1034’s distinction between nonexistent nodes and ENTs. It does not replace DNS lookup, wildcard synthesis, alias processing or all negative-caching rules. A timeout or SERVFAIL is not evidence for the NXDOMAIN cut described here (§§1,3.1,5).
DETAILS

Fictional offline DNS examples. Trees show conceptual label relationships, not resolver storage requirements. Selected helpers are bounded cache-policy models; they do not send DNS packets, validate signatures, implement all DNS errors or configure a resolver.

Read the RFC section ↗

All chapters in RFC 8020

Drawing view

Scroll the drawing to see every part. Playback controls stay above it.

RFC 9700 / CHAPTERS

Chapters

For full details, tables, algorithms, and exceptions, read the original RFC.

RFC status and corrections ↗