Hi, Patrik - > which also suspiciously seems to use the SOA TTL of 7200 > rather than the NXDOMAIN TTL of 18000
That is how negative cache TTL is calculated (by authoritative server). RFC2308 reads: (Negative cache) TTL is taken from the minimum of the SOA.MINIMUM field and SOA's TTL. Regards, Daisuke HIGASHI