Separate a missing name from missing data
02An existing name without a requested record type is different from a name that does not exist.
The failed classification would hide a real child; the illustration stops before a new cut is stored.
Source for this drawing: RFC 8020 · Read RFC section 3.1 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
NODATA does not create an NXDOMAIN cut.
- A resource record set (RRset) groups records of one type at a name. An empty non-terminal (ENT) is an existing name with no RRsets of its own but with descendants that have data. For example, leaf.branch.example. can have an A record while branch.example. itself has none. The intermediate branch still exists (§3.1; RFC 4592 §§2.2.2–2.2.3).
- For the selected ENT query, the correct result is NODATA: response code NOERROR (0) and an empty answer section. It is not NXDOMAIN. Here no alias is involved. NODATA is a description of the result, not a separate numeric DNS response code (§3.1).
- An ordinary existing host can likewise lack AAAA while having A records. A negative cache entry for missing data is scoped to name, requested type and class; an AAAA miss must not be turned into absence of the name or its A records (RFC 2308 §5, contrasted with RFC 8020 §3.2).
- Authoritative servers returning NXDOMAIN for an ENT are incorrect; RFC 8020 §5 explains how this can wrongly hide existing descendants and is incompatible with DNSSEC. The failed classification is stopped before creating a cut in this teaching scene. It is not a new RFC-mandated error response or a guarantee that every resolver repairs a bad answer.
- This publication clarifies RFC 1034’s distinction between nonexistent nodes and ENTs. It does not replace DNS lookup, wildcard synthesis, alias processing or all negative-caching rules. A timeout or SERVFAIL is not evidence for the NXDOMAIN cut described here (§§1,3.1,5).
Fictional offline DNS examples. Trees show conceptual label relationships, not resolver storage requirements. Selected helpers are bounded cache-policy models; they do not send DNS packets, validate signatures, implement all DNS errors or configure a resolver.
Read the RFC section ↗