What is DNS Caching?

DNS caching is a mechanism where DNS query results are stored locally or on an intermediate resolver for a limited period, defined by the time-to-live (TTL) value in the DNS resource record. This reduces the need to resolve the same domain name again from authoritative servers, cutting latency and network traffic.

When a DNS resolver receives a query response, it places that record into its cache along with the TTL received. For subsequent queries for the same domain within the TTL window, the resolver returns the cached answer without contacting upstream servers. The resolver discards the record when the TTL expires. Caches are used at every level: the operating system stub resolver, the local network resolver (often running on a router), the ISP's recursive resolver, and sometimes within browsers and applications.

DNS caching is critical to scaling the internet's naming system. Without it, every DNS request would travel the full hierarchy from stub resolver to root nameserver to TLD to authoritative server. Caching reduces that path to a single local lookup for most queries. However, it introduces possible staleness: if a domain changes its IP address, cached records remain until TTL expiry. Short TTLs (e.g., 60 seconds) minimize staleness but reduce caching benefits; long TTLs (e.g., 86400 seconds) maximize performance but slow propagation of changes. DNS cache poisoning is a known class of attack where an attacker causes a resolver to cache a forged record, redirecting traffic until the cache flushes.