Practical security for everyday technology.

A failed DNS lookup can stay cached after the record is fixed

Network engineer studying abstract dns diagram laptop.
AI-generated photographic illustration; not documentary photography.

You create a new subdomain, confirm the record in your DNS dashboard, and still get a name-not-found result. One possible explanation is that a resolver remembers an earlier answer saying the name did not exist.

DNS caches more than successful address lookups. It can also cache negative answers. That means adding a record does not instantly erase every previous negative response held elsewhere.

Two kinds of absence

RFC 2308 distinguishes a name error, NXDOMAIN, from an answer indicating that the requested record type has no data. The latter does not necessarily mean the name itself is absent. A hostname might have an IPv4 address record but no IPv6 address record, for example.

The standard also describes how the zone’s SOA information supplies the negative caching lifetime. The relevant value comes from the smaller of the SOA record’s TTL and its MINIMUM field. A resolver’s cached lifetime then counts down rather than lasting forever.

Compare answers before editing again

For your own domain, record the exact hostname, requested record type, lookup time, and resolver used. Compare the authoritative answer with the recursive resolver’s answer. This helps distinguish an incorrect published record from an older response still being served from a cache.

Imagine that you queried a hostname before creating it. Five minutes later, the authoritative server returns its new address, while the resolver you first used still returns NXDOMAIN. That pattern is consistent with negative caching; it does not prove that the control panel failed to save the record.

Do not treat every DNS failure as the same problem. A timeout, a server failure, and NXDOMAIN carry different information. Likewise, refreshing the web page or clearing a browser’s ordinary content cache may not clear the resolver involved.

Once the authoritative data is correct, repeated changes can make the timeline harder to understand. Keep a simple record of the answers and their remaining lifetimes, then investigate the layer that is actually returning the unexpected response.