Expire the cut and preserve class boundaries

Use remaining lifetimes, not a fresh timer for every cache hit.

• NXDOMAIN nonexistence is not permanent. The negative TTL (time to live) comes from RFC 2308 §3: the minimum of the SOA record’s TTL and its MINIMUM field. Chosen values 300 and 120 seconds yield 120 seconds. They are illustrative, not RFC 8020 defaults (§2).
• When cached time reaches zero, the negative answer MUST NOT be used again. Replies from the negative cache carry the SOA with its TTL reduced by elapsed time; a hit does not reset that lifetime (RFC 2308 §§5–6). At selected time 119 the remaining TTL is 1; at 120 this cut no longer authorizes a shortcut. Normal processing might find other data before querying upstream.
• If a resolver already has cached data beneath the cut, it MAY continue replying with that data until its own TTL expires. The selected positive entry has 60 seconds left when the 120-second cut is learned: it can be served at time 59, but not at 60 under this exception. That is permission, not a requirement to retain positives (§2).
• The revised cache rule applies to the same QCLASS as the negative answer. A class-IN cut does not deny a class-CH query even with an identical name. Here IN is class 1 and CH is class 3; the helper treats class numbers as separate keys (§3.2).
• The DNS tree is a conceptual model. Actual resolver storage MAY use a tree or another data structure (§1.1). Section 6 is explicitly non-normative: pruning cached positives is one approach, not a mandatory deletion algorithm. The existing-data MAY and implementation reasons reinforce why the cut rule is SHOULD.