Negative DNS Replies Drive Repeat Queries, APNIC Data Shows

The Domain Name System (DNS), the protocol that turns human-friendly domain names into the numeric IP addresses computers use to connect, handles an enormous number of 'no' answers every day. A new discussion on the APNIC Blog's PING podcast, published on 17 September 2026, shows that the exact way a DNS server delivers that 'no' can significantly change how much work the wider network has to do.

In the episode, APNIC Chief Scientist Geoff Huston and blog author George Michaelson continue a conversation about repeat queries seen in the APNIC Labs measurement experiment. APNIC Labs is the research and measurement arm of APNIC, the Regional Internet Registry for the Asia Pacific. Huston and Michaelson report that the number of repeat queries has changed over time as DNS protocol usage has changed. DNS records that did not exist when the problem was first observed now appear, creating multiple queries about multiple things for what looks like a single lookup.

Huston explores two aspects of DNS behaviour. The first is how different ways of answering 'no' affect the volume of queries and the amount of work required by authoritative servers (the servers that hold the official copy of a domain's records), intermediate resolvers (the servers that look up answers on behalf of clients and cache results), and clients (the devices or applications making the request). Common negative replies include NXDOMAIN (the name does not exist) and NODATA (the name exists but has no record of the requested type), and a server can also simply not respond at all. Huston says the results are sometimes surprising, with different ways of saying no leading to very different outcomes.

Resolvers typically cache both positive and negative answers for a period set by the authoritative server. The way a negative answer is expressed can change how long that cached answer is considered valid, and therefore how often clients and resolvers have to ask the same question again. Huston's measurements show that these choices have real consequences for workload.

The second aspect is the impact that alternative DNS transport protocols could have on query repetition and overall query load. Much of this repetition may be a consequence of the User Datagram Protocol (UDP), a connectionless transport that sends data in individual messages without first establishing a session, so a lost reply is not automatically retransmitted and the client must ask again. Many engineers have argued that the overhead of maintaining connection state for TCP (Transmission Control Protocol, a connection-oriented transport that establishes a reliable channel) and similar protocols made them unsuitable for DNS at scale. However, as the volume of unnecessary repeated queries continues to grow, it is possible that, end-to-end, maintaining protocol state may actually require less work than repeatedly handling the same queries.

For everyday internet users, these findings matter because repeated DNS queries can add delay and network load. A privacy-first encrypted DNS service such as AEU DNS, which offers DNS over HTTPS and DNS over TLS, can protect individual queries from on-path observation and gives users a resolver with a clear published privacy policy. That does not remove the protocol-level query repetition Huston describes, but it keeps the queries themselves confidential and lets users choose a resolver that commits to not logging or profiling their browsing.

The APNIC Blog post also points readers to a longer APNIC Blog article by Geoff Huston, 'What part of No is so hard for DNS to understand?', which examines the problem in more measurement detail. The podcast episode itself is available through Apple Podcasts, Spotify, YouTube, iHeartRadio, JioSaavn, Gaana and RSS.