Negative responses get cached even when setting `cache-max-negative-ttl: 1`

**Describe the bug**
Negative responses get cached even when setting `cache-max-negative-ttl: 1`

**To reproduce**
Steps to reproduce the behavior:
1. Verify unbound used by system in `/etc/resolv.conf`
2. Set `cache-max-negative-ttl: 1`
3. Restart unbound
4. Query non-existant domain (ex. `dig www.john.doe`)
5. See that query took some time (more than 10ms) and returned `NXDOMAIN`
```
...
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 44925
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;www.john.doe.			IN	A

;; AUTHORITY SECTION:
.			30	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2021082300 1800 900 604800 86400

;; Query time: 463 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Aug 23 12:36:58 IDT 2021
...
```
6. Wait for 5 secunds for negative cache TTL to end
7. Query again, look at "Query time" to identify whether cache was used (can be also identified by watching logs for "using cached" message from unbound when running with `log-queries` and `log-replies`)
```
...
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 44159
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;www.john.doe.			IN	A

;; AUTHORITY SECTION:
.			24	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2021082300 1800 900 604800 86400

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Aug 23 12:37:04 IDT 2021
...
```
**Expected behavior**
As stated in [unbound.conf(5)](https://github.com/NLnetLabs/unbound/blob/master/doc/unbound.conf.5.in):
```
cache-max-negative-ttl: <seconds>
    Time to live maximum for negative responses, 
    these have a SOA in the authority section that is limited in time.
    Default is 3600.  This applies to nxdomain and nodata answers.
```
I expect for the cache to end after `<seconds>`

**System:**
 - Unbound version: 1.13.1
 - OS: Gentoo (happens to me also on Arch)
 - `unbound -V` output:
```
Version 1.13.1

Configure line: --prefix=/usr --build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --docdir=/usr/share/doc/unbound-1.13.1-r2 --htmldir=/usr/share/doc/unbound-1.13.1-r2/html --with-sysroot=/ --libdir=/usr/lib64 --disable-debug --disable-gost --enable-dnscrypt --disable-dnstap --enable-ecdsa --disable-subnet --disable-cachedb --disable-static --enable-systemd --without-pythonmodule --without-pyunbound --without-pthreads --with-libnghttp2 --disable-flto --disable-rpath --enable-event-api --enable-ipsecmod --enable-tfo-client --enable-tfo-server --with-libevent=/usr --without-libhiredis --with-pidfile=/run/unbound.pid --with-rootkey-file=/etc/dnssec/root-anchors.txt --with-ssl=/usr --with-libexpat=/usr
Linked libs: libevent 2.1.11-stable (it uses epoll), OpenSSL 1.1.1k  25 Mar 2021
Linked modules: dns64 ipsecmod respip validator iterator
DNSCrypt feature available
TCP Fastopen feature available
```

**Additional information**
It is happening to me for a while now (from previous versions) and I just finally decided to write an issue about it


Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Negative responses get cached even when setting `cache-max-negative-ttl: 1` #533

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Uh oh!

Negative responses get cached even when setting cache-max-negative-ttl: 1 #533

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Negative responses get cached even when setting `cache-max-negative-ttl: 1` #533