What exactly is the purpose of networkaddress.cache.negative.ttl?

Issue

For the class InetAddress, it has a property "networkaddress.cache.negative.ttl". And the Javadoc says

networkaddress.cache.negative.ttl (default: 10)

Specified in java.security to indicate the caching policy for un-successful name lookups from the name service.. The value is specified as integer to indicate the number of seconds to cache the failure for un-successful lookups.
A value of 0 indicates "never cache". A value of -1 indicates "cache forever".

Pardon my dumb question, what is there to cache if a name lookup is unsuccessful? An unsuccessful name lookup means there is no IP address return so it can't be caching any IP address.

Does it mean that this parameter will just simply return "host not found" return-code during the caching period for the same name lookup instead of performing an actual DNS query?

Thanks

Solution

All (recursive) nameservers have the concept of negative TTL, that is how long to cache "data not found" type of answers.

This is given by authoritative nameservers in the SOA fields, the last item is the negative TTL. It could also be derived from the TTL of NSEC/NSEC3 records in case the domain has enabled DNSSEC.

Taking that into account allows the system to not over query for something already known not to exist. Like all caches, it is a performance optimization and a compromise between local memory (to store the cache) vs network IO (to send and wait for replies).

You can find more details at the DNS level on https://serverfault.com/questions/426807/how-long-does-negative-dns-caching-typically-last for example.

The Java framework seems to just inherit this idea and has a similar setting.

Answered By - Patrick Mevzek