[GH-ISSUE #2595] Recursor does not cache negative responses #1021

New issue

Open

opened 2026-03-16 01:18:00 +03:00 by kerem · 1 comment

kerem commented

2026-03-16 01:18:00 +03:00

Owner

Originally created by @divergentdave on GitHub (Nov 20, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2595

CachingClient in the resolver uses both DnsLru::insert() and DnsLru::negative(), but the recursor uses only DnsLru::insert_records(). This means the recursor may unnecessarily repeat requests, if it gets the same recursive query multiple times for a nonexistent record.

Originally created by @divergentdave on GitHub (Nov 20, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2595 `CachingClient` in the resolver uses both `DnsLru::insert()` and `DnsLru::negative()`, but the recursor uses only `DnsLru::insert_records()`. This means the recursor may unnecessarily repeat requests, if it gets the same recursive query multiple times for a nonexistent record.

kerem added the

perf

label

2026-03-16 01:18:00 +03:00

kerem commented

2026-03-16 01:18:11 +03:00

Author

Owner

@divergentdave commented on GitHub (Dec 6, 2024):

Special consideration will be required for NSEC RRs on either side of a zone cut. From RFC 4035 section 5.2:

Note that, for a signed delegation, there are two NSEC RRs associated with the delegated name. One NSEC RR resides in the parent zone and can be used to prove whether a DS RRset exists for the delegated name. The second NSEC RR resides in the child zone and identifies which RRsets are present at the apex of the child zone. ... A security-aware resolver MUST use the parent NSEC RR when attempting to prove that a DS RRset does not exist.

@divergentdave commented on GitHub (Dec 6, 2024): Special consideration will be required for NSEC RRs on either side of a zone cut. From RFC 4035 section 5.2: > Note that, for a signed delegation, there are two NSEC RRs associated with the delegated name. One NSEC RR resides in the parent zone and can be used to prove whether a DS RRset exists for the delegated name. The second NSEC RR resides in the child zone and identifies which RRsets are present at the apex of the child zone. ... A security-aware resolver MUST use the parent NSEC RR when attempting to prove that a DS RRset does not exist.

kerem referenced this issue

2026-03-16 02:52:20 +03:00

[PR #1021] [MERGED] Bump ring from 0.16.10 to 0.16.11 #1876