resolved: implement negative caching

11 files changed, 372 insertions, 116 deletions

diff --git a/src/resolve/resolved-dns-answer.c b/src/resolve/resolved-dns-answer.c
index fbc282550e..34c854cb3a 100644
--- a/src/resolve/resolved-dns-answer.c
+++ b/src/resolve/resolved-dns-answer.c
@@ -20,6 +20,7 @@
 ***/
 
 #include "resolved-dns-answer.h"
+#include "resolved-dns-domain.h"
 
 DnsAnswer *dns_answer_new(unsigned n) {
         DnsAnswer *a;
@@ -65,12 +66,75 @@ DnsAnswer *dns_answer_unref(DnsAnswer *a) {
 }
 
 int dns_answer_add(DnsAnswer *a, DnsResourceRecord *rr) {
+        unsigned i;
+        int r;
+
         assert(a);
         assert(rr);
 
+        for (i = 0; i < a->n_rrs; i++) {
+                r = dns_resource_record_equal(a->rrs[i], rr);
+                if (r < 0)
+                        return r;
+                if (r > 0) {
+                        /* Entry already exists, keep the entry with
+                         * the higher RR, or the one with TTL 0 */
+
+                        if (rr->ttl == 0 || (rr->ttl > a->rrs[i]->ttl && a->rrs[i]->ttl != 0)) {
+                                dns_resource_record_ref(rr);
+                                dns_resource_record_unref(a->rrs[i]);
+                                a->rrs[i] = rr;
+                        }
+
+                        return 0;
+                }
+        }
+
         if (a->n_rrs >= a->n_allocated)
                 return -ENOSPC;
 
         a->rrs[a->n_rrs++] = dns_resource_record_ref(rr);
+        return 1;
+}
+
+int dns_answer_contains(DnsAnswer *a, DnsResourceKey *key) {
+        unsigned i;
+        int r;
+
+        assert(a);
+        assert(key);
+
+        for (i = 0; i < a->n_rrs; i++) {
+                r = dns_resource_key_match_rr(key, a->rrs[i]);
+                if (r < 0)
+                        return r;
+                if (r > 0)
+                        return 1;
+        }
+
+        return 0;
+}
+
+int dns_answer_find_soa(DnsAnswer *a, DnsResourceKey *key, DnsResourceRecord **ret) {
+        unsigned i;
+
+        assert(a);
+        assert(key);
+        assert(ret);
+
+        for (i = 0; i < a->n_rrs; i++) {
+
+                if (a->rrs[i]->key->class != DNS_CLASS_IN)
+                        continue;
+
+                if (a->rrs[i]->key->type != DNS_TYPE_SOA)
+                        continue;
+
+                if (dns_name_endswith(DNS_RESOURCE_KEY_NAME(key), DNS_RESOURCE_KEY_NAME(a->rrs[i]->key))) {
+                        *ret = a->rrs[i];
+                        return 1;
+                }
+        }
+
         return 0;
 }
diff --git a/src/resolve/resolved-dns-answer.h b/src/resolve/resolved-dns-answer.h
index dc2ec3a461..249383b4b7 100644
--- a/src/resolve/resolved-dns-answer.h
+++ b/src/resolve/resolved-dns-answer.h
@@ -38,5 +38,7 @@ DnsAnswer *dns_answer_ref(DnsAnswer *a);
 DnsAnswer *dns_answer_unref(DnsAnswer *a);
 
 int dns_answer_add(DnsAnswer *a, DnsResourceRecord *rr);
+int dns_answer_contains(DnsAnswer *a, DnsResourceKey *key);
+int dns_answer_find_soa(DnsAnswer *a, DnsResourceKey *key, DnsResourceRecord **ret);
 
 DEFINE_TRIVIAL_CLEANUP_FUNC(DnsAnswer*, dns_answer_unref);
diff --git a/src/resolve/resolved-dns-cache.c b/src/resolve/resolved-dns-cache.c
index e42af41c78..6ea5d49fc4 100644
--- a/src/resolve/resolved-dns-cache.c
+++ b/src/resolve/resolved-dns-cache.c
@@ -20,6 +20,7 @@
 ***/
 
 #include "resolved-dns-cache.h"
+#include "resolved-dns-packet.h"
 
 /* Never cache more than 1K entries */
 #define CACHE_MAX 1024
@@ -32,6 +33,7 @@ static void dns_cache_item_free(DnsCacheItem *i) {
                 return;
 
         dns_resource_record_unref(i->rr);
+        dns_resource_key_unref(i->key);
         free(i);
 }
 
@@ -45,15 +47,15 @@ static void dns_cache_item_remove_and_free(DnsCache *c, DnsCacheItem *i) {
         if (!i)
                 return;
 
-        first = hashmap_get(c->rrsets, i->rr->key);
-        LIST_REMOVE(rrsets, first, i);
+        first = hashmap_get(c->by_key, i->key);
+        LIST_REMOVE(by_key, first, i);
 
         if (first)
-                assert_se(hashmap_replace(c->rrsets, first->rr->key, first) >= 0);
+                assert_se(hashmap_replace(c->by_key, first->key, first) >= 0);
         else
-                hashmap_remove(c->rrsets, i->rr->key);
+                hashmap_remove(c->by_key, i->key);
 
-        prioq_remove(c->expire, i, &i->expire_prioq_idx);
+        prioq_remove(c->by_expiry, i, &i->prioq_idx);
 
         dns_cache_item_free(i);
 }
@@ -63,26 +65,26 @@ void dns_cache_flush(DnsCache *c) {
 
         assert(c);
 
-        while ((i = hashmap_first(c->rrsets)))
+        while ((i = hashmap_first(c->by_key)))
                 dns_cache_item_remove_and_free(c, i);
 
-        assert(hashmap_size(c->rrsets) == 0);
-        assert(prioq_size(c->expire) == 0);
+        assert(hashmap_size(c->by_key) == 0);
+        assert(prioq_size(c->by_expiry) == 0);
 
-        hashmap_free(c->rrsets);
-        c->rrsets = NULL;
+        hashmap_free(c->by_key);
+        c->by_key = NULL;
 
-        prioq_free(c->expire);
-        c->expire = NULL;
+        prioq_free(c->by_expiry);
+        c->by_expiry = NULL;
 }
 
-void dns_cache_remove(DnsCache *c, DnsResourceKey *key) {
+static void dns_cache_remove(DnsCache *c, DnsResourceKey *key) {
         DnsCacheItem *i;
 
         assert(c);
         assert(key);
 
-        while ((i = hashmap_get(c->rrsets, key)))
+        while ((i = hashmap_get(c->by_key, key)))
                 dns_cache_item_remove_and_free(c, i);
 }
 
@@ -101,18 +103,18 @@ static void dns_cache_make_space(DnsCache *c, unsigned add) {
                 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *key = NULL;
                 DnsCacheItem *i;
 
-                if (prioq_size(c->expire) <= 0)
+                if (prioq_size(c->by_expiry) <= 0)
                         break;
 
-                if (prioq_size(c->expire) + add < CACHE_MAX)
+                if (prioq_size(c->by_expiry) + add < CACHE_MAX)
                         break;
 
-                i = prioq_peek(c->expire);
+                i = prioq_peek(c->by_expiry);
                 assert(i);
 
                 /* Take an extra reference to the key so that it
                  * doesn't go away in the middle of the remove call */
-                key = dns_resource_key_ref(i->rr->key);
+                key = dns_resource_key_ref(i->key);
                 dns_cache_remove(c, key);
         }
 }
@@ -127,61 +129,72 @@ void dns_cache_prune(DnsCache *c) {
         for (;;) {
                 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *key = NULL;
                 DnsCacheItem *i;
-                usec_t ttl;
 
-                i = prioq_peek(c->expire);
+                i = prioq_peek(c->by_expiry);
                 if (!i)
                         break;
 
-                ttl = i->rr->ttl * USEC_PER_SEC;
-                if (ttl > CACHE_TTL_MAX_USEC)
-                        ttl = CACHE_TTL_MAX_USEC;
-
                 if (t <= 0)
                         t = now(CLOCK_MONOTONIC);
 
-                if (i->timestamp + ttl > t)
+                if (i->until > t)
                         break;
 
                 /* Take an extra reference to the key so that it
                  * doesn't go away in the middle of the remove call */
-                key = dns_resource_key_ref(i->rr->key);
+                key = dns_resource_key_ref(i->key);
                 dns_cache_remove(c, key);
         }
 }
 
 static int dns_cache_item_prioq_compare_func(const void *a, const void *b) {
-        usec_t t, z;
         const DnsCacheItem *x = a, *y = b;
 
-        t = x->timestamp + x->rr->ttl * USEC_PER_SEC;
-        z = y->timestamp + y->rr->ttl * USEC_PER_SEC;
-
-        if (t < z)
+        if (x->until < y->until)
                 return -1;
-        if (t > z)
+        if (x->until > y->until)
                 return 1;
         return 0;
 }
 
-static void dns_cache_item_update(DnsCache *c, DnsCacheItem *i, DnsResourceRecord *rr, usec_t timestamp) {
+static int init_cache(DnsCache *c) {
+        int r;
+
+        r = prioq_ensure_allocated(&c->by_expiry, dns_cache_item_prioq_compare_func);
+        if (r < 0)
+                return r;
+
+        r = hashmap_ensure_allocated(&c->by_key, dns_resource_key_hash_func, dns_resource_key_compare_func);
+        if (r < 0)
+                return r;
+
+        return r;
+}
+
+static int dns_cache_link_item(DnsCache *c, DnsCacheItem *i) {
+        DnsCacheItem *first;
+        int r;
+
         assert(c);
         assert(i);
-        assert(rr);
 
-        if (!i->rrsets_prev) {
-                /* We are the first item in the list, we need to
-                 * update the key used in the hashmap */
+        r = prioq_put(c->by_expiry, i, &i->prioq_idx);
+        if (r < 0)
+                return r;
 
-                assert_se(hashmap_replace(c->rrsets, rr->key, i) >= 0);
+        first = hashmap_get(c->by_key, i->key);
+        if (first) {
+                LIST_PREPEND(by_key, first, i);
+                assert_se(hashmap_replace(c->by_key, first->key, first) >= 0);
+        } else {
+                r = hashmap_put(c->by_key, i->key, i);
+                if (r < 0) {
+                        prioq_remove(c->by_expiry, i, &i->prioq_idx);
+                        return r;
+                }
         }
 
-        dns_resource_record_ref(rr);
-        dns_resource_record_unref(i->rr);
-        i->rr = rr;
-
-        i->timestamp = timestamp;
-        prioq_reshuffle(c->expire, i, &i->expire_prioq_idx);
+        return 0;
 }
 
 static DnsCacheItem* dns_cache_get(DnsCache *c, DnsResourceRecord *rr) {
@@ -190,16 +203,42 @@ static DnsCacheItem* dns_cache_get(DnsCache *c, DnsResourceRecord *rr) {
         assert(c);
         assert(rr);
 
-        LIST_FOREACH(rrsets, i, hashmap_get(c->rrsets, rr->key))
-                if (dns_resource_record_equal(i->rr, rr))
+        LIST_FOREACH(by_key, i, hashmap_get(c->by_key, rr->key))
+                if (i->rr && dns_resource_record_equal(i->rr, rr))
                         return i;
 
         return NULL;
 }
 
-int dns_cache_put(DnsCache *c, DnsResourceRecord *rr, usec_t timestamp) {
+static void dns_cache_item_update_positive(DnsCache *c, DnsCacheItem *i, DnsResourceRecord *rr, usec_t timestamp) {
+        assert(c);
+        assert(i);
+        assert(rr);
+
+        i->type = DNS_CACHE_POSITIVE;
+
+        if (!i->by_key_prev) {
+                /* We are the first item in the list, we need to
+                 * update the key used in the hashmap */
+
+                assert_se(hashmap_replace(c->by_key, rr->key, i) >= 0);
+        }
+
+        dns_resource_record_ref(rr);
+        dns_resource_record_unref(i->rr);
+        i->rr = rr;
+
+        dns_resource_key_unref(i->key);
+        i->key = dns_resource_key_ref(rr->key);
+
+        i->until = timestamp + MIN(rr->ttl * USEC_PER_SEC, CACHE_TTL_MAX_USEC);
+
+        prioq_reshuffle(c->by_expiry, i, &i->prioq_idx);
+}
+
+static int dns_cache_put_positive(DnsCache *c, DnsResourceRecord *rr, usec_t timestamp) {
         _cleanup_(dns_cache_item_freep) DnsCacheItem *i = NULL;
-        DnsCacheItem *first = NULL, *existing;
+        DnsCacheItem *existing;
         int r;
 
         assert(c);
@@ -214,16 +253,48 @@ int dns_cache_put(DnsCache *c, DnsResourceRecord *rr, usec_t timestamp) {
         /* Entry exists already? Update TTL and timestamp */
         existing = dns_cache_get(c, rr);
         if (existing) {
-                dns_cache_item_update(c, existing, rr, timestamp);
+                dns_cache_item_update_positive(c, existing, rr, timestamp);
                 return 0;
         }
 
         /* Otherwise, add the new RR */
-        r = prioq_ensure_allocated(&c->expire, dns_cache_item_prioq_compare_func);
+        r = init_cache(c);
         if (r < 0)
                 return r;
 
-        r = hashmap_ensure_allocated(&c->rrsets, dns_resource_key_hash_func, dns_resource_key_compare_func);
+        dns_cache_make_space(c, 1);
+
+        i = new0(DnsCacheItem, 1);
+        if (!i)
+                return -ENOMEM;
+
+        i->type = DNS_CACHE_POSITIVE;
+        i->key = dns_resource_key_ref(rr->key);
+        i->rr = dns_resource_record_ref(rr);
+        i->until = timestamp + MIN(i->rr->ttl * USEC_PER_SEC, CACHE_TTL_MAX_USEC);
+        i->prioq_idx = PRIOQ_IDX_NULL;
+
+        r = dns_cache_link_item(c, i);
+        if (r < 0)
+                return r;
+
+        i = NULL;
+        return 0;
+}
+
+static int dns_cache_put_negative(DnsCache *c, DnsResourceKey *key, int rcode, usec_t timestamp, uint32_t soa_ttl) {
+        _cleanup_(dns_cache_item_freep) DnsCacheItem *i = NULL;
+        int r;
+
+        assert(c);
+        assert(key);
+
+        dns_cache_remove(c, key);
+
+        if (!IN_SET(rcode, DNS_RCODE_SUCCESS, DNS_RCODE_NXDOMAIN))
+                return 0;
+
+        r = init_cache(c);
         if (r < 0)
                 return r;
 
@@ -233,51 +304,70 @@ int dns_cache_put(DnsCache *c, DnsResourceRecord *rr, usec_t timestamp) {
         if (!i)
                 return -ENOMEM;
 
-        i->rr = dns_resource_record_ref(rr);
-        i->timestamp = timestamp;
-        i->expire_prioq_idx = PRIOQ_IDX_NULL;
+        i->type = rcode == DNS_RCODE_SUCCESS ? DNS_CACHE_NODATA : DNS_CACHE_NXDOMAIN;
+        i->key = dns_resource_key_ref(key);
+        i->until = timestamp + MIN(soa_ttl * USEC_PER_SEC, CACHE_TTL_MAX_USEC);
+        i->prioq_idx = PRIOQ_IDX_NULL;
 
-        r = prioq_put(c->expire, i, &i->expire_prioq_idx);
+        r = dns_cache_link_item(c, i);
         if (r < 0)
                 return r;
 
-        first = hashmap_get(c->rrsets, i->rr->key);
-        if (first) {
-                LIST_PREPEND(rrsets, first, i);
-                assert_se(hashmap_replace(c->rrsets, first->rr->key, first) >= 0);
-        } else {
-                r = hashmap_put(c->rrsets, i->rr->key, i);
-                if (r < 0) {
-                        prioq_remove(c->expire, i, &i->expire_prioq_idx);
-                        return r;
-                }
-        }
-
         i = NULL;
-
         return 0;
 }
 
-int dns_cache_put_answer(DnsCache *c, DnsAnswer *answer, usec_t timestamp) {
-        unsigned i, added = 0;
+int dns_cache_put(DnsCache *c, DnsQuestion *q, int rcode, DnsAnswer *answer, usec_t timestamp) {
+        unsigned i;
         int r;
 
         assert(c);
         assert(answer);
 
-        /* First iteration, delete all matching old RRs, so that we
-         * only keep complete rrsets in place. */
+        /* First, delete all matching old RRs, so that we only keep
+         * complete by_key in place. */
+        for (i = 0; i < q->n_keys; i++)
+                dns_cache_remove(c, q->keys[i]);
         for (i = 0; i < answer->n_rrs; i++)
                 dns_cache_remove(c, answer->rrs[i]->key);
 
-        dns_cache_make_space(c, answer->n_rrs);
+        /* We only care for positive replies and NXDOMAINs, on all
+         * other replies we will simply flush the respective entries,
+         * and that's it */
+
+        if (!IN_SET(rcode, DNS_RCODE_SUCCESS, DNS_RCODE_NXDOMAIN))
+                return 0;
+
+        /* Make some space for our new entries */
+        dns_cache_make_space(c, answer->n_rrs + q->n_keys);
 
-        /* Second iteration, add in new RRs */
-        for (added = 0; added < answer->n_rrs; added++) {
-                if (timestamp <= 0)
-                        timestamp = now(CLOCK_MONOTONIC);
+        if (timestamp <= 0)
+                timestamp = now(CLOCK_MONOTONIC);
 
-                r = dns_cache_put(c, answer->rrs[added], timestamp);
+        /* Second, add in positive entries for all contained RRs */
+        for (i = 0; i < answer->n_rrs; i++) {
+                r = dns_cache_put_positive(c, answer->rrs[i], timestamp);
+                if (r < 0)
+                        goto fail;
+        }
+
+        /* Third, add in negative entries for all keys with no RR */
+        for (i = 0; i < q->n_keys; i++) {
+                DnsResourceRecord *soa = NULL;
+
+                r = dns_answer_contains(answer, q->keys[i]);
+                if (r < 0)
+                        goto fail;
+                if (r > 0)
+                        continue;
+
+                r = dns_answer_find_soa(answer, q->keys[i], &soa);
+                if (r < 0)
+                        goto fail;
+                if (r == 0)
+                        continue;
+
+                r = dns_cache_put_negative(c, q->keys[i], rcode, timestamp, MIN(soa->soa.minimum, soa->ttl));
                 if (r < 0)
                         goto fail;
         }
@@ -288,16 +378,19 @@ fail:
         /* Adding all RRs failed. Let's clean up what we already
          * added, just in case */
 
-        for (i = 0; i < added; i++)
+        for (i = 0; i < q->n_keys; i++)
+                dns_cache_remove(c, q->keys[i]);
+        for (i = 0; i < answer->n_rrs; i++)
                 dns_cache_remove(c, answer->rrs[i]->key);
 
         return r;
 }
 
-int dns_cache_lookup(DnsCache *c, DnsQuestion *q, DnsAnswer **ret) {
+int dns_cache_lookup(DnsCache *c, DnsQuestion *q, int *rcode, DnsAnswer **ret) {
         _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
         unsigned i, n = 0;
         int r;
+        bool nxdomain = false;
 
         assert(c);
         assert(q);
@@ -305,24 +398,34 @@ int dns_cache_lookup(DnsCache *c, DnsQuestion *q, DnsAnswer **ret) {
 
         if (q->n_keys <= 0) {
                 *ret = NULL;
+                *rcode = 0;
                 return 0;
         }
 
         for (i = 0; i < q->n_keys; i++) {
                 DnsCacheItem *j;
 
-                j = hashmap_get(c->rrsets, q->keys[i]);
+                j = hashmap_get(c->by_key, q->keys[i]);
                 if (!j) {
                         /* If one question cannot be answered we need to refresh */
                         *ret = NULL;
+                        *rcode = 0;
                         return 0;
                 }
 
-                LIST_FOREACH(rrsets, j, j)
-                        n++;
+                LIST_FOREACH(by_key, j, j) {
+                        if (j->rr)
+                                n++;
+                        else if (j->type == DNS_CACHE_NXDOMAIN)
+                                nxdomain = true;
+                }
         }
 
-        assert(n > 0);
+        if (n <= 0) {
+                *ret = NULL;
+                *rcode = nxdomain ? DNS_RCODE_NXDOMAIN : DNS_RCODE_SUCCESS;
+                return 1;
+        }
 
         answer = dns_answer_new(n);
         if (!answer)
@@ -331,17 +434,18 @@ int dns_cache_lookup(DnsCache *c, DnsQuestion *q, DnsAnswer **ret) {
         for (i = 0; i < q->n_keys; i++) {
                 DnsCacheItem *j;
 
-                j = hashmap_get(c->rrsets, q->keys[i]);
-                LIST_FOREACH(rrsets, j, j) {
-                        r = dns_answer_add(answer, j->rr);
-                        if (r < 0)
-                                return r;
+                j = hashmap_get(c->by_key, q->keys[i]);
+                LIST_FOREACH(by_key, j, j) {
+                        if (j->rr) {
+                                r = dns_answer_add(answer, j->rr);
+                                if (r < 0)
+                                        return r;
+                        }
                 }
         }
 
-        assert(n >= answer->n_rrs);
-
         *ret = answer;
+        *rcode = DNS_RCODE_SUCCESS;
         answer = NULL;
 
         return n;
diff --git a/src/resolve/resolved-dns-cache.h b/src/resolve/resolved-dns-cache.h
index 1ede5bfd81..6f5bf45a38 100644
--- a/src/resolve/resolved-dns-cache.h
+++ b/src/resolve/resolved-dns-cache.h
@@ -31,27 +31,31 @@
 typedef struct DnsCacheItem DnsCacheItem;
 
 typedef struct DnsCache {
-        Hashmap *rrsets;
-        Prioq *expire;
+        Hashmap *by_key;
+        Prioq *by_expiry;
 } DnsCache;
 
 #include "resolved-dns-rr.h"
 #include "resolved-dns-question.h"
 #include "resolved-dns-answer.h"
 
+typedef enum DnsCacheItemType {
+        DNS_CACHE_POSITIVE,
+        DNS_CACHE_NODATA,
+        DNS_CACHE_NXDOMAIN,
+} DnsCacheItemType;
+
 typedef struct DnsCacheItem {
+        DnsResourceKey *key;
         DnsResourceRecord *rr;
-        usec_t timestamp;
-        unsigned expire_prioq_idx;
-        LIST_FIELDS(DnsCacheItem, rrsets);
+        usec_t until;
+        DnsCacheItemType type;
+        unsigned prioq_idx;
+        LIST_FIELDS(DnsCacheItem, by_key);
 } DnsCacheItem;
 
 void dns_cache_flush(DnsCache *c);
 void dns_cache_prune(DnsCache *c);
 
-void dns_cache_remove(DnsCache *c, DnsResourceKey *key);
-
-int dns_cache_put(DnsCache *c, DnsResourceRecord *rr, usec_t timestamp);
-int dns_cache_put_answer(DnsCache *c, DnsAnswer *answer, usec_t timestamp);
-
-int dns_cache_lookup(DnsCache *c, DnsQuestion *q, DnsAnswer **ret);
+int dns_cache_put(DnsCache *c, DnsQuestion *q, int rcode, DnsAnswer *answer, usec_t timestamp);
+int dns_cache_lookup(DnsCache *c, DnsQuestion *q, int *rcode, DnsAnswer **answer);
diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c
index 527102943a..e5a4a40341 100644
--- a/src/resolve/resolved-dns-packet.c
+++ b/src/resolve/resolved-dns-packet.c
@@ -711,6 +711,34 @@ int dns_packet_read_rr(DnsPacket *p, DnsResourceRecord **ret, size_t *start) {
                 memcpy(&rr->aaaa.in6_addr, d, sizeof(struct in6_addr));
                 break;
 
+        case DNS_TYPE_SOA:
+                r = dns_packet_read_name(p, &rr->soa.mname, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_read_name(p, &rr->soa.rname, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_read_uint32(p, &rr->soa.serial, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_read_uint32(p, &rr->soa.refresh, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_read_uint32(p, &rr->soa.retry, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_read_uint32(p, &rr->soa.expire, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_read_uint32(p, &rr->soa.minimum, NULL);
+                break;
+
         default:
                 r = dns_packet_read(p, rdlength, &d, NULL);
                 if (r < 0)
diff --git a/src/resolve/resolved-dns-packet.h b/src/resolve/resolved-dns-packet.h
index ab46b33c48..b8370def32 100644
--- a/src/resolve/resolved-dns-packet.h
+++ b/src/resolve/resolved-dns-packet.h
@@ -21,14 +21,16 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  ***/
 
-typedef struct DnsPacketHeader DnsPacketHeader;
-typedef struct DnsPacket DnsPacket;
-
 #include <inttypes.h>
 
 #include "macro.h"
 #include "sparse-endian.h"
 #include "hashmap.h"
+#include "in-addr-util.h"
+
+typedef struct DnsPacketHeader DnsPacketHeader;
+typedef struct DnsPacket DnsPacket;
+
 #include "resolved-dns-rr.h"
 #include "resolved-dns-question.h"
 #include "resolved-dns-answer.h"
diff --git a/src/resolve/resolved-dns-query.c b/src/resolve/resolved-dns-query.c
index 80526bbc28..a56e295f4f 100644
--- a/src/resolve/resolved-dns-query.c
+++ b/src/resolve/resolved-dns-query.c
@@ -335,8 +335,8 @@ void dns_query_transaction_process_reply(DnsQueryTransaction *t, DnsPacket *p) {
         if (r < 0) {
                 dns_query_transaction_complete(t, DNS_QUERY_INVALID_REPLY);
                 return;
-        } else if (r > 0)
-                dns_cache_put_answer(&t->scope->cache, p->answer, 0);
+        } else
+                dns_cache_put(&t->scope->cache, p->question, DNS_PACKET_RCODE(p), p->answer, 0);
 
         if (DNS_PACKET_RCODE(p) == DNS_RCODE_SUCCESS)
                 dns_query_transaction_complete(t, DNS_QUERY_SUCCESS);
@@ -416,14 +416,18 @@ static int dns_query_transaction_go(DnsQueryTransaction *t) {
         t->n_attempts++;
         t->received = dns_packet_unref(t->received);
         t->cached = dns_answer_unref(t->cached);
+        t->cached_rcode = 0;
 
         /* First, let's try the cache */
         dns_cache_prune(&t->scope->cache);
-        r = dns_cache_lookup(&t->scope->cache, t->question, &t->cached);
+        r = dns_cache_lookup(&t->scope->cache, t->question, &t->cached_rcode, &t->cached);
         if (r < 0)
                 return r;
         if (r > 0) {
-                dns_query_transaction_complete(t, DNS_QUERY_SUCCESS);
+                if (t->cached_rcode == DNS_RCODE_SUCCESS)
+                        dns_query_transaction_complete(t, DNS_QUERY_SUCCESS);
+                else
+                        dns_query_transaction_complete(t, DNS_QUERY_FAILURE);
                 return 0;
         }
 
@@ -707,7 +711,8 @@ fail:
 void dns_query_ready(DnsQuery *q) {
         DnsQueryTransaction *t;
         DnsQueryState state = DNS_QUERY_NO_SERVERS;
-        DnsPacket *received = NULL;
+        DnsAnswer *failure_answer = NULL;
+        int failure_rcode = 0, failure_ifindex = 0;
         Iterator i;
 
         assert(q);
@@ -737,7 +742,7 @@ void dns_query_ready(DnsQuery *q) {
                         } else {
                                 q->answer = dns_answer_ref(t->cached);
                                 q->answer_ifindex = t->scope->link ? t->scope->link->ifindex : 0;
-                                q->answer_rcode = 0;
+                                q->answer_rcode = t->cached_rcode;
                         }
 
                         dns_query_complete(q, DNS_QUERY_SUCCESS);
@@ -748,7 +753,16 @@ void dns_query_ready(DnsQuery *q) {
                  * whether we find anything better, but if not, return
                  * its response packet */
                 if (t->state == DNS_QUERY_FAILURE) {
-                        received = t->received;
+                        if (t->received) {
+                                failure_answer = t->received->answer;
+                                failure_ifindex = t->received->ifindex;
+                                failure_rcode = DNS_PACKET_RCODE(t->received);
+                        } else {
+                                failure_answer = t->cached;
+                                failure_ifindex = t->scope->link ? t->scope->link->ifindex : 0;
+                                failure_rcode = t->cached_rcode;
+                        }
+
                         state = DNS_QUERY_FAILURE;
                         continue;
                 }
@@ -758,9 +772,9 @@ void dns_query_ready(DnsQuery *q) {
         }
 
         if (state == DNS_QUERY_FAILURE) {
-                q->answer = dns_answer_ref(received->answer);
-                q->answer_ifindex = received->ifindex;
-                q->answer_rcode = DNS_PACKET_RCODE(received);
+                q->answer = dns_answer_ref(failure_answer);
+                q->answer_ifindex = failure_ifindex;
+                q->answer_rcode = failure_rcode;
         }
 
         dns_query_complete(q, state);
diff --git a/src/resolve/resolved-dns-query.h b/src/resolve/resolved-dns-query.h
index 2756048be5..c26abb8853 100644
--- a/src/resolve/resolved-dns-query.h
+++ b/src/resolve/resolved-dns-query.h
@@ -60,6 +60,7 @@ struct DnsQueryTransaction {
 
         DnsPacket *sent, *received;
         DnsAnswer *cached;
+        int cached_rcode;
 
         sd_event_source *timeout_event_source;
         unsigned n_attempts;
diff --git a/src/resolve/resolved-dns-question.c b/src/resolve/resolved-dns-question.c
index 026a67d7b3..056bd6eb64 100644
--- a/src/resolve/resolved-dns-question.c
+++ b/src/resolve/resolved-dns-question.c
@@ -65,9 +65,20 @@ DnsQuestion *dns_question_unref(DnsQuestion *q) {
 }
 
 int dns_question_add(DnsQuestion *q, DnsResourceKey *key) {
+        unsigned i;
+        int r;
+
         assert(q);
         assert(key);
 
+        for (i = 0; i < q->n_keys; i++) {
+                r = dns_resource_key_equal(q->keys[i], key);
+                if (r < 0)
+                        return r;
+                if (r > 0)
+                        return 0;
+        }
+
         if (q->n_keys >= q->n_allocated)
                 return -ENOSPC;
 
diff --git a/src/resolve/resolved-dns-rr.c b/src/resolve/resolved-dns-rr.c
index c9b564b544..f68eb18425 100644
--- a/src/resolve/resolved-dns-rr.c
+++ b/src/resolve/resolved-dns-rr.c
@@ -199,6 +199,9 @@ DnsResourceRecord* dns_resource_record_unref(DnsResourceRecord *rr) {
                 else if (rr->key->type == DNS_TYPE_HINFO) {
                         free(rr->hinfo.cpu);
                         free(rr->hinfo.os);
+                } else if (rr->key->type == DNS_TYPE_SOA) {
+                        free(rr->soa.mname);
+                        free(rr->soa.rname);
                 } else if (!IN_SET(rr->key->type, DNS_TYPE_A, DNS_TYPE_AAAA))
                         free(rr->generic.data);
 
@@ -229,7 +232,20 @@ int dns_resource_record_equal(const DnsResourceRecord *a, const DnsResourceRecor
                 return memcmp(&a->a.in_addr, &b->a.in_addr, sizeof(struct in_addr)) == 0;
         else if (a->key->type == DNS_TYPE_AAAA)
                 return memcmp(&a->aaaa.in6_addr, &b->aaaa.in6_addr, sizeof(struct in6_addr)) == 0;
-        else
+        else if (a->key->type == DNS_TYPE_SOA) {
+                r = dns_name_equal(a->soa.mname, b->soa.mname);
+                if (r <= 0)
+                        return r;
+                r = dns_name_equal(a->soa.rname, b->soa.rname);
+                if (r <= 0)
+                        return r;
+
+                return a->soa.serial  == b->soa.serial &&
+                       a->soa.refresh == b->soa.refresh &&
+                       a->soa.retry   == b->soa.retry &&
+                       a->soa.expire  == b->soa.expire &&
+                       a->soa.minimum == b->soa.minimum;
+        } else
                 return a->generic.size == b->generic.size &&
                         memcmp(a->generic.data, b->generic.data, a->generic.size) == 0;
 }
diff --git a/src/resolve/resolved-dns-rr.h b/src/resolve/resolved-dns-rr.h
index 3ab01fac8d..418bbede65 100644
--- a/src/resolve/resolved-dns-rr.h
+++ b/src/resolve/resolved-dns-rr.h
@@ -104,6 +104,16 @@ struct DnsResourceRecord {
                 struct {
                         struct in6_addr in6_addr;
                 } aaaa;
+
+                struct {
+                        char *mname;
+                        char *rname;
+                        uint32_t serial;
+                        uint32_t refresh;
+                        uint32_t retry;
+                        uint32_t expire;
+                        uint32_t minimum;
+                } soa;
         };
 };