NXDOMAIN, no data, and negative caching

NXDOMAIN means the queried name does not exist. A no-data answer means the name exists, but it has no record of the requested type.

The difference appears in a full response:

dig A missing.example.com
dig AAAA existing.example.com

An NXDOMAIN response has status: NXDOMAIN. A no-data response normally has status: NOERROR with an empty answer section. The second name might still have an A, MX, or TXT record; it simply lacks the requested AAAA data.

NXDOMAIN applies to the queried name, while no-data is specific to the name and record type. This matters when deciding which additional query can prove the name exists.

Resolvers cache negative answers too. The authoritative response includes the zone’s SOA in the authority section. Its TTL and the SOA’s negative-cache field determine how long the negative result may remain cached.

Creating a record immediately after someone queried the missing name therefore may not produce an immediate result through that resolver. Lowering the new record’s TTL cannot evict an older cached NXDOMAIN response.

SERVFAIL, REFUSED, and a timeout are different failures. They can indicate DNSSEC validation, authority, policy, or network problems. Calling all of them “DNS propagation” hides the useful evidence.

Compare a recursive answer with authority when a newly created name remains missing:

dig @1.1.1.1 A new.example.com
authoritative_server=$(dig NS example.com +short | head -n 1)
dig @"$authoritative_server" A new.example.com +norecurse

If authority returns the record and the resolver returns NXDOMAIN with a decreasing negative TTL, wait for that cached result or use a resolver without it. If authority also returns NXDOMAIN, correct the zone.

Your action is to find or create one no-data example and one nonexistent name. Record the status, answer count, SOA in the authority section, and the negative TTL evidence for each.