On 19/12/2025 18.01, pawmal-knot--- via knot-resolver-users wrote:
it seems vanilla kresd (5.7.6-cznic.1~bookworm), when receives NODATA response (NOERROR, all RRs: 0) from remote authoritative server, stores record in cache with TTL=32768.
Where is this value coming from/how can we alter it?
(Seems hardcoded, not derived from SOA expiry or TTL.)

In that instance the authoritative server sends no SOA nor TTL.  However, the particular number seems to be a bug.  I'd probably go for the minimal TTL setting for that case.  I'll look at that later.

--Vladimir