Negative Caching of DNS Resolution Failures

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 14
Abstract: In the DNS, resolvers employ caching to reduce both latency for end users and load on authoritative name servers. The process of resolution may result in one of three types of responses: (1) a response containing the requested data, (2) a response indicating the requested data does not exist, or (3) a non-response due to a resolution failure in which the resolver does not receive any useful information regarding the data's existence. This document concerns itself only with the third type. RFC 2308 specifies requirements for DNS negative caching. There, caching of TYPE 2 responses is mandatory and caching of TYPE 3 responses is optional. This document updates RFC 2308 to require negative caching for DNS resolution failures. RFC 4035 allows DNSSEC validation failure caching. This document updates RFC 4035 to require caching for DNSSEC validation failures. RFC 4697 prohibits aggressive requerying for NS records at a failed zone's parent zone. This document updates RFC 4697 to expand this requirement to all query types and to all ancestor zones.
Publication Date: 2023-12-01
Status Note: Proposed Standard
DOI: 10.17487/RFC9520
Link: https://doi.org/10.17487/RFC9520
Author(s): Duane Wessels
William Carroll
Matthew Thomas
Keyword(s): DNS, Negative Caching

Latest version of IETF RFC 9520

Document Versions — IETF RFC 9520

▶ IETF RFC 9520 (2023-12-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 1034 [Active*]
IETF RFC 1035 [Active, Amended*]
IETF RFC 2119 [Active*]
IETF RFC 2308 [Active*]
IETF RFC 4035 [Active*]
RFC4697 — RFC4697 EXTERNAL
IETF RFC 8174 [Active*]

Bibliographic Reference(s)

10.1109-SP54263.2024.00046 — TuDoor EXTERNAL
10.1145-3355369.3355570 — ROLL_YOUR_ROOT EXTERNAL
10.1145-3487552.3487824 — TsuNAME EXTERNAL
IETF.draft-muks-dnsop-dns-thundering-herd-00 — I-D.muks-dnsop-dns-thundering-herd EXTERNAL
Michaleson, G., Wallström, P., Arends, R., and G. Huston, "Roll Over and Die?", February 2010, <https://www.potaroo.net/ispcol/2010-02/rollover.html>. EXTERNAL
Verisign, "Observations on Resolver Behavior During DNS Outages", January 2022, <https://blog.verisign.com/security/facebook-dns-outage/>. EXTERNAL
Sullivan, A., "Dyn, DDoS, and DNS", March 2017, <https://ccnso.icann.org/sites/default/files/file/field-file-attach/2017-04/presentation-oracle-dyn-ddos-dns-13mar17-en.pdf>. EXTERNAL
Janardhan, S., "More details about the October 4 outage", October 2021, <https://engineering.fb.com/2021/10/05/networking-traffic/outage-details/>. EXTERNAL
Wessels, D. and M. Thomas, "Botnet Traffic Observed at Various Levels of the DNS Hierarchy", May 2021, <https://indico.dns-oarc.net/event/38/contributions/841/>. EXTERNAL
IETF RFC 882 [Superseded*]
IETF RFC 883 [Superseded*]
IETF RFC 4686 [Active*]
IETF RFC 4732 [Active*]
IETF RFC 5452 [Active*]
IETF RFC 6891 [Active*]
IETF RFC 7766 [Active*]
RFC7858 — RFC7858 EXTERNAL
RFC7873 — RFC7873 EXTERNAL
RFC8484 — RFC8484 EXTERNAL
IETF RFC 8767 [Active*]
RFC8914 — RFC8914 EXTERNAL
RFC9250 — RFC9250 EXTERNAL

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9520.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 9520, Negative Caching of DNS Resolution Failures. Available at https://doi.org/10.17487/RFC9520

Snippet:

IETF RFC 9520, Negative Caching of DNS Resolution Failures. Available at https://doi.org/10.17487/RFC9520

HTML (ISO 690 compliant)

Preview:

IETF RFC 9520, Negative Caching of DNS Resolution Failures. Available at https://doi.org/10.17487/RFC9520

Snippet:

<span class="citation"><cite>IETF RFC 9520</cite>, Negative Caching of DNS Resolution Failures. Available at <a href="https://doi.org/10.17487/RFC9520" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9520</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 9520, Negative Caching of DNS Resolution Failures
doi: 10.17487/RFC9520
url: https://doi.org/10.17487/RFC9520

Snippet:

<li>
<cite id="bib-rfc9520">IETF RFC 9520</cite>, Negative Caching of DNS Resolution Failures
<span class="doi">10.17487/RFC9520</span>
</li>