Handle cache, absence, aliases and retries
03Different reply categories cause different transitions; an alias at a probe is not the original answer.
A timeout or another response code may lead to a retry of the same CHILD probe at a different server for the same ANCESTOR. Neither the retry nor its success is guaranteed.
Source for this drawing: RFC 9156 · Read RFC section 3 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
The algorithm first answers the original query from cache if it can. Before sending a minimised probe, it also checks cached information for CHILD with the original QTYPE: cached NOERROR, including NODATA, advances without that probe; cached NXDOMAIN follows the resolver’s RFC 8020 support (§3 steps0,5). These are distinct cache checks.
- The algorithm first answers the original query from cache if it can. Before sending a minimised probe, it also checks cached information for CHILD with the original QTYPE: cached NOERROR, including NODATA, advances without that probe; cached NXDOMAIN follows the resolver’s RFC 8020 support (§3 steps0,5). These are distinct cache checks.
- A referral caches the NS record set from Authority and restarts at step 1. A non-referral NOERROR probe answer, including NODATA or a CNAME (canonical-name alias), is cached and the resolver continues building the original QNAME from step 3. Do not follow a probe CNAME as though it answered the user’s different original question (§3 steps6a,6c).
- For an NXDOMAIN (name does not exist) probe or usable cached CHILD answer, this algorithm returns NXDOMAIN for the original name and stops when the resolver supports RFC 8020. Without that support, go back to step 3. NXDOMAIN and NODATA are not interchangeable (§3 steps5,6d). RFC 8020§2 retains negative TTLs, a MAY to serve existing cached descendant data until expiry, and a validating resolver’s MAY to require a DNSSEC-validated cut. After an alias chain, the denied name is its final name, not automatically the initial QNAME. These ordinary cache/validation conditions are assumed by our supplied cut-support decision.
- A DNAME (subtree-name redirection) probe response is handled as if received for the original query; restart at step 0 for the new name derived from the DNAME target. A completed original query can also require another name lookup because of CNAME or DNAME; restart from step 0 there too (§3 steps3,6b). Alias processing and loop limits remain ordinary resolver responsibilities.
- On a timeout or another response code, an implementation may retry step 6 with a different server for the same ANCESTOR (§3 step 6e). This is an allowed choice, not a MUST retry, a successful delivery, or a recommendation to reveal the full name automatically.
- These scenes are separate decision examples. They do not run all failures after one success. The model consumes supplied response categories, not real packets; it does not implement cache TTLs, DNSSEC validation, alias substitution, bailiwick checks or a complete resolver.
Documentation-domain examples. Suffixes, supplied response events and label budgets are bounded teaching models, not a DNS wire codec, validating resolver or live privacy measurement.
Read the RFC section ↗