Caching, TTLs, and saying no
The walk you learned in lesson 1 — root, then TLD, then authoritative — almost never happens. If it did, the root servers would field every DNS query on Earth and the system would have collapsed in about 1985.
What happens instead is that somebody already asked. Watch the same question twice:
A hit skips the whole hierarchy, not part of it
The second lookup contacted nobody. That is the shape of the saving: a
cache hit does not shorten the walk, it removes it entirely, and the answer comes back before the first attempt had finished talking to the root.
Two details decide how well this works:
- The TTL counts down as an answer is passed along, and never restarts. A record with 300 seconds left is served with 300 seconds left, not 300 fresh ones.
- Delegations and glue are cached separately from answers, and usually for far longer.
So even a genuine miss on
www.example.comnormally skips the root and the TLD, and goes straight to the authoritative server.
Caching "no"
Negative answers get cached too, and this surprises people. When a name genuinely does not exist, the NXDOMAIN comes back with an SOA record from the closest enclosing zone, and a field in that SOA says how long the "no" may be remembered.
Without it, every typo, every stale link and every misconfigured client in the world would walk the tree from the root, forever, on every attempt.
Key takeaways
- The full walk is the exception. Almost every DNS query in the world is answered from a cache, and that is why the system scales.
- A cache hit removes the hierarchy entirely rather than shortening it.
- TTLs count down as an answer is passed on and are never refreshed, so a zone operator keeps control of how long an answer can live.
- Delegations and glue are cached separately and for longer, so even a miss usually skips the root and the TLD.
- Negative answers are cached too, with the duration set by the SOA — and a TTL you lower today only takes effect after the old one expires.