RFC 8020 / START HERE
NXDOMAIN cut, before the details
NXDOMAIN is DNS response code 3: the denied domain name does not exist. An NXDOMAIN cut reuses that fact for names below it.
DNS names form a tree. If gone.example. does not exist, a resolver can remember that and avoid another upstream lookup for a.gone.example. This saves unnecessary queries while the cached denial remains valid.
The idea in one picture
Learn a denied name
Remember its scope
Answer a descendant
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
RFC 8020 is a November 2016 Proposed Standard updating RFCs 1034 and 2308. It clarifies subtree negative caching and its exceptions, rather than changing the DNS wire format or replacing the entire DNS protocol.
A familiar example
Imagine a directory telling you a branch is absent. Looking for another entry below that branch would add no information. But an empty existing branch can still have children; aliases can point elsewhere, and cached absence expires. These distinctions matter in DNS.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Reuse a missing-name answer below its nodeA resolver can avoid another upstream query when the requested name is inside an unexpired NXDOMAIN cut.→
- Separate a missing name from missing dataAn existing name without a requested record type is different from a name that does not exist.→
- Attach the cut to the denied nameAliases and SOA records make it unsafe to assume that the original question or zone apex is the denied node.→
- Expire the cut and preserve class boundariesA negative answer has a lifetime and scope; optional cached-data reuse is a separate rule.→
- Carry DNSSEC evidence and show the riskAn optimization magnifies a false denial unless the resolver can trust its source.→
This introduction explains RFC 8020 (2016). Read the original RFC ↗