Network & Infrastructure / DNS, DNSSEC & Service Discovery
Negative DNS caching after a corrected service record
A missing service record is created, yet some clients continue receiving a negative answer. Their resolvers can legitimately retain the earlier nonexistence response for its negative-cache lifetime.
Environment and inputs: Authoritative and recursive DNS infrastructure; BIND examples are conceptual and require release-matched configuration. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Collect authoritative answers, cached answers, response codes and the SOA information accompanying the original negative response. Identify each recursive resolver and its remaining cached lifetime.
Explain the result
Negative answers are cached too. Publishing a positive record does not actively erase every recursive cache, and changing the new record's TTL does not retroactively shorten an existing negative entry.
Plan the fix
Plan record creation and cutovers before clients request the name. Where operationally justified, use the resolver's supported targeted cache procedure instead of restarting the entire name service.
Check the result and rollback
Verify authoritative correctness and observe recursive behavior through the relevant expiry window. Revert a cutover if the service depends on immediate universal visibility that the caching model cannot provide.