Hi,Follow-up on my original report — I've done additional testing that narrows down the issue further.New finding:I tested with a non-existent domain (NXDOMAIN response, cached via SOA minimum = 86400s). With stale-answer-client-timeout 0, every single client query triggers an upstream authoritative lookup, even though the negative cache TTL hasn't expired.Test results:
With stale-answer-client-timeout 0: client query volume ~2,700, upstream queries ~1,200 (negative cache completely bypassed) Without stale-answer-client-timeout 0: same client query volume, upstream queries ~10 (negative cache working correctly) What this tells us:The bug isn't limited to stale refresh of expired RRsets. It appears that stale-answer-client-timeout 0 causes BIND to treat negative cache entries (NXDOMAIN/NODATA) as stale and refresh them on every query — even when they are still within their valid TTL (SOA minimum field).This means the stale logic is incorrectly overriding the normal negative caching mechanism entirely, not just providing faster responses for expired entries.My original hypothesis (A/AAAA amplification) still applies as a secondary factor — for names with only A records, the AAAA query returns NODATA (negative cache), which triggers this bug on every curl request. But the root cause is the negative cache bypass, not the A/AAAA mismatch.Is this a known issue? Would appreciate any guidance on whether this is expected or a confirmed bug.Best, [root@test-device01 named]# dig @127.0.0.1 dns1.sys.srvtest ; <<>> DiG 9.18.21 <<>> @127.0.0.1 dns1.sys.srvtest ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 47867 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ; COOKIE: cbe311ad4235cce0010000006a4e0f594102da0ed46e3374 (good) ;; QUESTION SECTION: ;dns1.sys.srvtest. IN A ;; AUTHORITY SECTION: srvtest. 600 IN SOA srvtest. root.srvtest. 1783500169 10800 900 604800 86400 ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP) ;; WHEN: Wed Jul 08 16:50:33 CST 2026 ;; MSG SIZE rcvd: 110 [root@test-device01 named]# dig @127.0.0.1 dns1.sys.srvtest ; <<>> DiG 9.18.21 <<>> @127.0.0.1 dns1.sys.srvtest ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 36488 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ; COOKIE: 95fc94bfe6e977c5010000006a4e0f5accdb1ed2e3ab071c (good) ;; QUESTION SECTION: ;dns1.sys.srvtest. IN A ;; AUTHORITY SECTION: srvtest. 599 IN SOA srvtest. root.srvtest. 1783500169 10800 900 604800 86400 ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP) ;; WHEN: Wed Jul 08 16:50:34 CST 2026 ;; MSG SIZE rcvd: 110 [root@test-device01 named]# dig @127.0.0.1 dns1.sys.srvtest ; <<>> DiG 9.18.21 <<>> @127.0.0.1 dns1.sys.srvtest ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 32983 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ; COOKIE: 14d340cb98270086010000006a4e0f5a554550dbef818cf7 (good) ;; QUESTION SECTION: ;dns1.sys.srvtest. IN A ;; AUTHORITY SECTION: srvtest. 600 IN SOA srvtest. root.srvtest. 1783500169 10800 900 604800 86400 ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP) ;; WHEN: Wed Jul 08 16:50:34 CST 2026 ;; MSG SIZE rcvd: 110 [root@test-device01 named]# dig @127.0.0.1 dns1.sys.srvtest ; <<>> DiG 9.18.21 <<>> @127.0.0.1 dns1.sys.srvtest ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 30506 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ; COOKIE: 35125af12e7b4997010000006a4e0f5b0eba273eeab582a9 (good) ;; QUESTION SECTION: ;dns1.sys.srvtest. IN A ;; AUTHORITY SECTION: srvtest. 599 IN SOA srvtest. root.srvtest. 1783500169 10800 900 604800 86400 ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP) ;; WHEN: Wed Jul 08 16:50:35 CST 2026 ;; MSG SIZE rcvd: 110 [root@test-device01 named]# dig @127.0.0.1 dns1.sys.srvtest ; <<>> DiG 9.18.21 <<>> @127.0.0.1 dns1.sys.srvtest ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 63975 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ; COOKIE: 75e5f275bad1bb11010000006a4e0f5bd589f781fc63596b (good) ;; QUESTION SECTION: ;dns1.sys.srvtest. IN A ;; AUTHORITY SECTION: srvtest. 600 IN SOA srvtest. root.srvtest. 1783500169 10800 900 604800 86400 ;; Query time: 1 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP) ;; WHEN: Wed Jul 08 16:50:35 CST 2026 ;; MSG SIZE rcvd: 110 [root@test-device01 named]# dig @127.0.0.1 dns1.sys.srvtest ; <<>> DiG 9.18.21 <<>> @127.0.0.1 dns1.sys.srvtest ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 5170 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ; COOKIE: 0f00ac92fb11f159010000006a4e0f5cea3c30e7d69e3e65 (good) ;; QUESTION SECTION: ;dns1.sys.srvtest. IN A ;; AUTHORITY SECTION: srvtest. 599 IN SOA srvtest. root.srvtest. 1783500169 10800 900 604800 86400 ;; Query time: 1 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP) ;; WHEN: Wed Jul 08 16:50:36 CST 2026 ;; MSG SIZE rcvd: 110 [root@test-device01 named]# /usr/local/named/bin/dnstap-read /home/named/dnstap |grep dns1.sys.srvtest 08-Jul-2026 16:50:31.635 CQ 127.0.0.1:32298 -> 127.0.0.1:53 UDP 53b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:31.062 CQ 127.0.0.1:46438 -> 127.0.0.1:53 UDP 53b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:31.635 CR 127.0.0.1:32298 <- 127.0.0.1:53 UDP 110b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:31.062 CR 127.0.0.1:46438 <- 127.0.0.1:53 UDP 110b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:31.635 FQ 0.0.0.0:25022 -> 192.168.11.213:53 UDP 69b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:31.062 FQ 0.0.0.0:27320 -> 192.168.3.69:53 UDP 69b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:31.884 FR 0.0.0.0:25022 <- 192.168.11.213:53 UDP 110b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:31.299 FR 0.0.0.0:27320 <- 192.168.3.69:53 UDP 110b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:32.660 CQ 127.0.0.1:46226 -> 127.0.0.1:53 UDP 53b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:32.660 CR 127.0.0.1:46226 <- 127.0.0.1:53 UDP 110b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:32.661 FQ 0.0.0.0:27291 -> 192.168.3.69:53 UDP 69b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:32.898 FR 0.0.0.0:27291 <- 192.168.3.69:53 UDP 110b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:33.203 CQ 127.0.0.1:25296 -> 127.0.0.1:53 UDP 53b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:33.684 CQ 127.0.0.1:49147 -> 127.0.0.1:53 UDP 53b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:33.204 CR 127.0.0.1:25296 <- 127.0.0.1:53 UDP 110b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:33.684 CR 127.0.0.1:49147 <- 127.0.0.1:53 UDP 110b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:33.204 FQ 0.0.0.0:34713 -> 192.168.3.69:53 UDP 69b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:33.684 FQ 0.0.0.0:60884 -> 192.168.11.213:53 UDP 69b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:33.429 FR 0.0.0.0:34713 <- 192.168.3.69:53 UDP 110b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:33.933 FR 0.0.0.0:60884 <- 192.168.11.213:53 UDP 110b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:35.058 CQ 127.0.0.1:21162 -> 127.0.0.1:53 UDP 53b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:34.132 CQ 127.0.0.1:29752 -> 127.0.0.1:53 UDP 53b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:34.596 CQ 127.0.0.1:58008 -> 127.0.0.1:53 UDP 53b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:35.058 CR 127.0.0.1:21162 <- 127.0.0.1:53 UDP 110b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:34.132 CR 127.0.0.1:29752 <- 127.0.0.1:53 UDP 110b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:34.596 CR 127.0.0.1:58008 <- 127.0.0.1:53 UDP 110b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:35.058 FQ 0.0.0.0:63212 -> 192.168.3.69:53 UDP 69b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:34.132 FQ 0.0.0.0:38523 -> 192.168.3.69:53 UDP 69b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:34.596 FQ 0.0.0.0:63821 -> 192.168.3.69:53 UDP 69b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:34.358 FR 0.0.0.0:38523 <- 192.168.3.69:53 UDP 110b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:34.821 FR 0.0.0.0:63821 <- 192.168.3.69:53 UDP 110b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:35.284 FR 0.0.0.0:63212 <- 192.168.3.69:53 UDP 110b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:35.507 CQ 127.0.0.1:62584 -> 127.0.0.1:53 UDP 53b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:36.005 CQ 127.0.0.1:31312 -> 127.0.0.1:53 UDP 53b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:35.507 CR 127.0.0.1:62584 <- 127.0.0.1:53 UDP 110b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:36.005 CR 127.0.0.1:31312 <- 127.0.0.1:53 UDP 110b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:35.508 FQ 0.0.0.0:52288 -> 192.168.11.213:53 UDP 69b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:36.005 FQ 0.0.0.0:43026 -> 192.168.3.69:53 UDP 69b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:35.752 FR 0.0.0.0:52288 <- 192.168.11.213:53 UDP 110b dns1.sys.srvtest/IN/A 08-Jul-2026 16:50:36.232 FR 0.0.0.0:43026 <- 192.168.3.69:53 UDP 110b dns1.sys.srvtest/IN/A At 2026-07-07 13:21:41, "Ondřej Surý" <[email protected]> wrote: >Hi, > >if you think there's a bug in BIND 9, please fill an issue in our GitLab and >follow the template >that will guide you through the steps needed and ask you for all the material >we need to be >able to diagnose and reproduce the issue: > >https://gitlab.isc.org/isc-projects/bind9/-/work_items/new?description_template=Bug > >Thanks, >Ondrej >-- >Ondřej Surý (He/Him) >[email protected] > >ADHD brain at work: I sometimes lose track of my inbox. Please feel free to >send a gentle nudge if you're waiting on a reply! > >My working hours and your working hours may be different. Please do not feel >obligated to reply outside your normal working hours. > >> On 6. 7. 2026, at 18:39, fitwateys <[email protected]> wrote: >> >> Hi, >> >> I'm reporting a potential issue observed in BIND 9.20.24 with the >> stale-answer-client-timeout option. >> >> Environment: >> • BIND version: 9.20.24 >> • Role: Caching/forwarding resolver (localdns) >> • The localdns forwards queries for the sys.srvtest zone to an internal >> authoritative DNS server. >> • TTL for transfer.sys.srvtest: 120 seconds (A record only) >> >> Configuration (related): >> >> stale-answer-enable yes; >> stale-cache-enable yes; >> stale-answer-client-timeout 0;zone "sys.srvtest" { >> type forward; >> forwarders { <internal_auth_ip>; }; >> }; >> >> Observation: >> • Client queries received by localdns for transfer.sys.srvtest: ~2,700 >> • Queries from localdns to the authoritative server for >> transfer.sys.srvtest: ~1,200 >> >> With a TTL of 120s, the expected authoritative query volume would be roughly >> total_queries / 120 ≈ 22. The observed 1,200 is approximately 55x higher >> than expected. >> >> After removing stale-answer-client-timeout 0: >> • Client queries to localdns: ~2,700 (similar traffic) >> • Queries from localdns to the authoritative server: ~10 (close to >> expected) >> >> Hypothesis: >> >> The queried name transfer.sys.srvtest only has an A record configured on the >> authoritative server. Since clients (e.g. curl) typically send both A and >> AAAA queries simultaneously, each client request generates two lookups: >> • A query: cache hit, served from cache >> • AAAA query: no record exists, potentially triggering repeated >> authoritative lookups >> >> With stale-answer-client-timeout 0, BIND may attempt to refresh stale AAAA >> negative cache entries on every query, amplifying the authoritative query >> volume. Without this setting, BIND relies on normal negative caching >> (max-ncache-ttl), reducing unnecessary authoritative queries. >> >> Question: >> Is this expected behavior? I would expect stale-answer-client-timeout 0 to >> only affect the stale response timing (return stale immediately vs. wait for >> authoritative), not to cause additional authoritative lookups for records >> with valid TTLs. Could there be a bug where the stale refresh logic is also >> triggered for negative cache entries (NODATA/NXDOMAIN)? >> >> Please let me know if this is a known behavior or if additional debugging >> information (query logs, packet captures) would be helpful. >> -- >> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from >> this list.
-- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.
