Negative caching TTL

What it means

Resolvers cache absence as well as presence. When a query returns NXDOMAIN or an empty answer, the reply includes the zone's SOA record, and the answer may be cached for the smaller of the SOA's own TTL and its MINIMUM field (RFC 2308). RFC 2308 suggests resolvers cap it, with one to three hours as a sensible default.

This explains a common surprise. Someone checks _dmarc.example.com before creating it, gets NXDOMAIN, then publishes the record, and that resolver keeps answering "does not exist" until the negative cache expires.

Avoid querying records before they exist, or keep the SOA minimum modest.