Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm writing a DNS resolver and am building a spreadsheet of when a DNS record should be cached, and not be cached... but it's harder than it first looks (to me at least).

Is there consolidated test cases for DNS caching that I can refer to? All the RFCs seem to have many revisions, and the requirements on caching are inconsistent at best. This is further complicated by the re-definitions of the SOA record.

An improperly cached DNS record can mean that I'm poisoning the cache with invalid records.

The most relevant example I can think of is where a fake referral is generated for an NS, A, or MX.

  1. When should validation of that referral be done?
  2. How is that referral validated?
  3. Should I traverse from the root servers again?
share|improve this question

See and the many entries linked from there.

A short answer would be that you should only cache the answer when it comes from a server that you would normally trust for the the relevant domain.

share|improve this answer
Aye, there is the rub. I'm having trouble defining what 'normal' is. What are the conditions in which a record should be cached? – LamonteCristo Dec 2 '10 at 4:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.