Support TTL from SOA for NXDOMAIN & NODATA cache entries. Bug 1395

21 files changed, 202 insertions, 10 deletions

diff --git a/test/confs/0183 b/test/confs/0183
index 6699237a2..8cd4c82d4 100644
--- a/test/confs/0183
+++ b/test/confs/0183
@@ -10,6 +10,15 @@ dns_ipv4_lookup = *
 queue_run_in_order
 
 
+# ----- ACL -----
+
+begin acl
+
+delay:
+  accept
+	delay = 3s
+	message = y
+
 # ----- Routers -----
 
 begin routers
@@ -31,6 +40,13 @@ useryz:
 
 lookuphost:
   driver = dnslookup
+  local_parts = !userd
+  transport = smtp
+  no_more
+
+delay:
+  driver = dnslookup
+  condition =	${acl {delay}}
   transport = smtp
   no_more
 
diff --git a/test/dnszones-src/db.example.com b/test/dnszones-src/db.example.com
index b9aca04d1..683772f77 100644
--- a/test/dnszones-src/db.example.com
+++ b/test/dnszones-src/db.example.com
@@ -16,6 +16,9 @@
 ; the use of V4NET and V6NET. These networks should be such that no real
 ; host ever uses them.
 
+; really short neg-cache interval, for testing NXDOMAIN caching
+example.com.     SOA     exim.test.ex. hostmaster.exim.test.ex 1430683638 1200 120 604800 2
+
 example.com.     NS      exim.example.com.
 
 ; The real example.com has an SPF record; duplicate that here
diff --git a/test/scripts/0000-Basic/0183 b/test/scripts/0000-Basic/0183
index 7dd6ff5ea..cf7600ef2 100644
--- a/test/scripts/0000-Basic/0183
+++ b/test/scripts/0000-Basic/0183
@@ -11,3 +11,8 @@ exim -d -bt userx@nonexist.test.ex abcd@nonexist.test.ex abcd@ten-1.test.ex user
 1
 exim -d -bt srv@test.again.dns srv@test.fail.dns
 ****
+#
+# Set up a negative-cache entry with a short ttl, check it expires
+2
+exim -d -bt userx@nonexist.example.com userd@nonexist.example.com
+****
diff --git a/test/src/fakens.c b/test/src/fakens.c
index 583b01282..6d8a99df5 100644
--- a/test/src/fakens.c
+++ b/test/src/fakens.c
@@ -59,7 +59,7 @@ as such then the response will have the "AD" bit set.
 
 Any DNS record line can be prefixed with "NXDOMAIN ";
 The record will be ignored (but the prefix set still applied);
-This lets us return a DNSSEC NXDOMAIN.
+This lets us return a DNSSEC NXDOMAIN (=> HOST_NOT_FOUND).
 
 Any DNS record line can be prefixed with "AA "
 if all the records found by a lookup are marked
@@ -763,22 +763,23 @@ if (zonefile == NULL)
 
 (void)sprintf(CS buffer, "%s/dnszones/%s", argv[1], zonefile);
 
-/* Initialize the start of the response packet. We don't have to fake up
-everything, because we know that Exim will look only at the answer and
-additional section parts. */
+/* Initialize the start of the response packet. */
 
 memset(packet, 0, 12);
 pk += 12;
 
 /* Open the zone file. */
 
-f = fopen(CS buffer, "r");
-if (f == NULL)
+if (!(f = fopen(CS buffer, "r")))
   {
   fprintf(stderr, "fakens: failed to open %s: %s\n", buffer, strerror(errno));
   return NO_RECOVERY;
   }
 
+header->qr = 1;     /* query */
+header->opcode = QUERY; /* standard query */
+header->tc = 0;     /* no trucation */
+
 /* Find the records we want, and add them to the result. */
 
 count = 0;
@@ -789,12 +790,14 @@ header->ancount = htons(count);
 /* If the AA bit should be set (as indicated by the AA prefix in the zone file),
 we are expected to return some records in the authoritative section. Bind9: If
 there is data in the answer section, the authoritative section contains the NS
-records, otherwise it contains the SOA record.  Currently we mimic this
-behaviour for the first case (there is some answer record).
+records, otherwise it contains the SOA record.  Mimic that.
 */
 
-if (aa)
-  find_records(f, zone, zone[0] == '.' ? zone+1 : zone, US"NS", 2, &pk, &count, NULL, NULL);
+if (strcmp(qtype, "SOA") != 0 && strcmp(qtype, "NS") != 0)
+  if (count)
+    find_records(f, zone, zone[0] == '.' ? zone+1 : zone, US"NS", 2, &pk, &count, NULL, NULL);
+  else
+    find_records(f, zone, zone[0] == '.' ? zone+1 : zone, US"SOA", 3, &pk, &count, NULL, NULL);
 header->nscount = htons(count - ntohs(header->ancount));
 
 /* There is no need to return any additional records because Exim no longer
diff --git a/test/stderr/0002 b/test/stderr/0002
index 8f85e7146..f0b7776f7 100644
--- a/test/stderr/0002
+++ b/test/stderr/0002
@@ -298,6 +298,7 @@ looking up host name for V4NET.0.0.1
 DNS lookup of 1.0.0.V4NET.in-addr.arpa (PTR) using fakens
 DNS lookup of 1.0.0.V4NET.in-addr.arpa (PTR) succeeded
 IP address lookup yielded "ten-1.test.ex"
+ writing neg-cache entry for ten-1.test.ex-AAAA-41, ttl 3600
 DNS lookup of ten-1.test.ex (A) using fakens
 DNS lookup of ten-1.test.ex (A) succeeded
 ten-1.test.ex V4NET.0.0.1 mx=-1 sort=xx 
diff --git a/test/stderr/0094 b/test/stderr/0094
index 26cf91605..b59d608fc 100644
--- a/test/stderr/0094
+++ b/test/stderr/0094
@@ -83,12 +83,14 @@ DNS lookup of 90.99.99.V4NET.in-addr.arpa (PTR) using fakens
 DNS lookup of 90.99.99.V4NET.in-addr.arpa (PTR) succeeded
 IP address lookup yielded "oneback.test.ex"
   alias "host1.masq.test.ex"
+ writing neg-cache entry for oneback.test.ex-AAAA-41, ttl 3600
 DNS lookup of oneback.test.ex (A) using fakens
 DNS lookup of oneback.test.ex (A) succeeded
 oneback.test.ex V4NET.99.99.90 mx=-1 sort=xx 
 checking addresses for oneback.test.ex
 Forward DNS security status: unverified
   V4NET.99.99.90 OK
+ writing neg-cache entry for host1.masq.test.ex-AAAA-41, ttl 3600
 DNS lookup of host1.masq.test.ex (A) using fakens
 DNS lookup of host1.masq.test.ex (A) succeeded
 host1.masq.test.ex V4NET.90.90.90 mx=-1 sort=xx 
diff --git a/test/stderr/0183 b/test/stderr/0183
index 0aaba1d73..24fcc5015 100644
--- a/test/stderr/0183
+++ b/test/stderr/0183
@@ -25,6 +25,8 @@ userx in "usery:userz"? no (end of list)
 useryz router skipped: local_parts mismatch
 --------> lookuphost router <--------
 local_part=userx domain=test.again.dns
+checking local_parts
+userx in "!userd"? yes (end of list)
 calling lookuphost router
 lookuphost router called for userx@test.again.dns
   domain = test.again.dns
@@ -32,6 +34,7 @@ DNS lookup of test.again.dns (MX) using fakens
 DNS lookup of test.again.dns (MX) gave TRY_AGAIN
 test.again.dns in dns_again_means_nonexist? no (option unset)
 returning DNS_AGAIN
+ writing neg-cache entry for test.again.dns-MX-c1, ttl -1
 lookuphost router: defer for userx@test.again.dns
   message: host lookup did not complete
 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
@@ -52,6 +55,8 @@ abcd in "usery:userz"? no (end of list)
 useryz router skipped: local_parts mismatch
 --------> lookuphost router <--------
 local_part=abcd domain=test.again.dns
+checking local_parts
+abcd in "!userd"? yes (end of list)
 calling lookuphost router
 lookuphost router called for abcd@test.again.dns
   domain = test.again.dns
@@ -76,12 +81,15 @@ abcd in "usery:userz"? no (end of list)
 useryz router skipped: local_parts mismatch
 --------> lookuphost router <--------
 local_part=abcd domain=ten-1.test.ex
+checking local_parts
+abcd in "!userd"? yes (end of list)
 calling lookuphost router
 lookuphost router called for abcd@ten-1.test.ex
   domain = ten-1.test.ex
 DNS lookup of ten-1.test.ex (MX) using fakens
 DNS lookup of ten-1.test.ex (MX) gave NO_DATA
 returning DNS_NODATA
+ writing neg-cache entry for ten-1.test.ex-MX-c1, ttl 3600
 DNS lookup of ten-1.test.ex (A) using fakens
 DNS lookup of ten-1.test.ex (A) succeeded
 fully qualified name = ten-1.test.ex
@@ -124,6 +132,7 @@ DNS lookup of test.again.dns (A) using fakens
 DNS lookup of test.again.dns (A) gave TRY_AGAIN
 test.again.dns in dns_again_means_nonexist? no (option unset)
 returning DNS_AGAIN
+ writing neg-cache entry for test.again.dns-A-41, ttl -1
 useryz router: defer for usery@test.again.dns
   message: host lookup for test.again.dns did not complete (DNS timeout?)
 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
@@ -171,6 +180,8 @@ xyz in "usery:userz"? no (end of list)
 useryz router skipped: local_parts mismatch
 --------> lookuphost router <--------
 local_part=xyz domain=ten-1.test.ex
+checking local_parts
+xyz in "!userd"? yes (end of list)
 calling lookuphost router
 lookuphost router called for xyz@ten-1.test.ex
   domain = ten-1.test.ex
@@ -216,12 +227,15 @@ userx in "usery:userz"? no (end of list)
 useryz router skipped: local_parts mismatch
 --------> lookuphost router <--------
 local_part=userx domain=test.fail.dns
+checking local_parts
+userx in "!userd"? yes (end of list)
 calling lookuphost router
 lookuphost router called for userx@test.fail.dns
   domain = test.fail.dns
 DNS lookup of test.fail.dns (MX) using fakens
 DNS lookup of test.fail.dns (MX) gave NO_RECOVERY
 returning DNS_FAIL
+ writing neg-cache entry for test.fail.dns-MX-c1, ttl -1
 lookuphost router: defer for userx@test.fail.dns
   message: host lookup did not complete
 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
@@ -242,6 +256,8 @@ abcd in "usery:userz"? no (end of list)
 useryz router skipped: local_parts mismatch
 --------> lookuphost router <--------
 local_part=abcd domain=test.fail.dns
+checking local_parts
+abcd in "!userd"? yes (end of list)
 calling lookuphost router
 lookuphost router called for abcd@test.fail.dns
   domain = test.fail.dns
@@ -266,12 +282,15 @@ abcd in "usery:userz"? no (end of list)
 useryz router skipped: local_parts mismatch
 --------> lookuphost router <--------
 local_part=abcd domain=ten-1.test.ex
+checking local_parts
+abcd in "!userd"? yes (end of list)
 calling lookuphost router
 lookuphost router called for abcd@ten-1.test.ex
   domain = ten-1.test.ex
 DNS lookup of ten-1.test.ex (MX) using fakens
 DNS lookup of ten-1.test.ex (MX) gave NO_DATA
 returning DNS_NODATA
+ writing neg-cache entry for ten-1.test.ex-MX-c1, ttl 3600
 DNS lookup of ten-1.test.ex (A) using fakens
 DNS lookup of ten-1.test.ex (A) succeeded
 fully qualified name = ten-1.test.ex
@@ -313,6 +332,7 @@ doing DNS lookup
 DNS lookup of test.fail.dns (A) using fakens
 DNS lookup of test.fail.dns (A) gave NO_RECOVERY
 returning DNS_FAIL
+ writing neg-cache entry for test.fail.dns-A-41, ttl -1
 useryz router: defer for usery@test.fail.dns
   message: host lookup for test.fail.dns did not complete (DNS timeout?)
 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
@@ -360,6 +380,8 @@ xyz in "usery:userz"? no (end of list)
 useryz router skipped: local_parts mismatch
 --------> lookuphost router <--------
 local_part=xyz domain=ten-1.test.ex
+checking local_parts
+xyz in "!userd"? yes (end of list)
 calling lookuphost router
 lookuphost router called for xyz@ten-1.test.ex
   domain = ten-1.test.ex
@@ -405,12 +427,15 @@ userx in "usery:userz"? no (end of list)
 useryz router skipped: local_parts mismatch
 --------> lookuphost router <--------
 local_part=userx domain=nonexist.test.ex
+checking local_parts
+userx in "!userd"? yes (end of list)
 calling lookuphost router
 lookuphost router called for userx@nonexist.test.ex
   domain = nonexist.test.ex
 DNS lookup of nonexist.test.ex (MX) using fakens
 DNS lookup of nonexist.test.ex (MX) gave HOST_NOT_FOUND
 returning DNS_NOMATCH
+ writing neg-cache entry for nonexist.test.ex-MX-c1, ttl 3600
 lookuphost router declined for userx@nonexist.test.ex
 "more" is false: skipping remaining routers
 no more routers
@@ -432,6 +457,8 @@ abcd in "usery:userz"? no (end of list)
 useryz router skipped: local_parts mismatch
 --------> lookuphost router <--------
 local_part=abcd domain=nonexist.test.ex
+checking local_parts
+abcd in "!userd"? yes (end of list)
 calling lookuphost router
 lookuphost router called for abcd@nonexist.test.ex
   domain = nonexist.test.ex
@@ -457,12 +484,15 @@ abcd in "usery:userz"? no (end of list)
 useryz router skipped: local_parts mismatch
 --------> lookuphost router <--------
 local_part=abcd domain=ten-1.test.ex
+checking local_parts
+abcd in "!userd"? yes (end of list)
 calling lookuphost router
 lookuphost router called for abcd@ten-1.test.ex
   domain = ten-1.test.ex
 DNS lookup of ten-1.test.ex (MX) using fakens
 DNS lookup of ten-1.test.ex (MX) gave NO_DATA
 returning DNS_NODATA
+ writing neg-cache entry for ten-1.test.ex-MX-c1, ttl 3600
 DNS lookup of ten-1.test.ex (A) using fakens
 DNS lookup of ten-1.test.ex (A) succeeded
 fully qualified name = ten-1.test.ex
@@ -504,6 +534,7 @@ doing DNS lookup
 DNS lookup of nonexist.test.ex (A) using fakens
 DNS lookup of nonexist.test.ex (A) gave HOST_NOT_FOUND
 returning DNS_NOMATCH
+ writing neg-cache entry for nonexist.test.ex-A-41, ttl 3600
 useryz router: defer for usery@nonexist.test.ex
   message: lookup of host "nonexist.test.ex" failed in useryz router
 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
@@ -551,6 +582,8 @@ xyz in "usery:userz"? no (end of list)
 useryz router skipped: local_parts mismatch
 --------> lookuphost router <--------
 local_part=xyz domain=ten-1.test.ex
+checking local_parts
+xyz in "!userd"? yes (end of list)
 calling lookuphost router
 lookuphost router called for xyz@ten-1.test.ex
   domain = ten-1.test.ex
@@ -595,6 +628,7 @@ DNS lookup of _smtp._tcp.test.again.dns (SRV) using fakens
 DNS lookup of _smtp._tcp.test.again.dns (SRV) gave TRY_AGAIN
 _smtp._tcp.test.again.dns in dns_again_means_nonexist? no (option unset)
 returning DNS_AGAIN
+ writing neg-cache entry for _smtp._tcp.test.again.dns-SRV-c1, ttl -1
 test.again.dns in "test.fail.dns"? no (end of list)
 srv router: defer for srv@test.again.dns
   message: host lookup did not complete
@@ -614,17 +648,103 @@ srv router called for srv@test.fail.dns
 DNS lookup of _smtp._tcp.test.fail.dns (SRV) using fakens
 DNS lookup of _smtp._tcp.test.fail.dns (SRV) gave NO_RECOVERY
 returning DNS_FAIL
+ writing neg-cache entry for _smtp._tcp.test.fail.dns-SRV-c1, ttl -1
 test.fail.dns in "test.fail.dns"? yes (matched "test.fail.dns")
 DNS_FAIL treated as DNS_NODATA (domain in srv_fail_domains)
 DNS lookup of test.fail.dns (MX) using fakens
 DNS lookup of test.fail.dns (MX) gave NO_RECOVERY
 returning DNS_FAIL
+ writing neg-cache entry for test.fail.dns-MX-c1, ttl -1
 test.fail.dns in "test.fail.dns"? yes (matched "test.fail.dns")
 DNS_FAIL treated as DNS_NODATA (domain in mx_fail_domains)
 DNS lookup of test.fail.dns (A) using fakens
 DNS lookup of test.fail.dns (A) gave NO_RECOVERY
 returning DNS_FAIL
+ writing neg-cache entry for test.fail.dns-A-c1, ttl -1
 srv router: defer for srv@test.fail.dns
   message: host lookup did not complete
 search_tidyup called
 >>>>>>>>>>>>>>>> Exim pid=pppp (main) terminating with rc=1 >>>>>>>>>>>>>>>>
+Exim version x.yz ....
+changed uid/gid: forcing real = effective
+  uid=uuuu gid=CALLER_GID pid=pppp
+configuration file is TESTSUITE/test-config
+admin user
+dropping to exim gid; retaining priv uid
+originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
+sender address = CALLER@myhost.test.ex
+Address testing: uid=uuuu gid=EXIM_GID euid=uuuu egid=EXIM_GID
+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+Testing userx@nonexist.example.com
+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+Considering userx@nonexist.example.com
+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+routing userx@nonexist.example.com
+--------> srv router <--------
+local_part=userx domain=nonexist.example.com
+checking local_parts
+userx in "^srv"? no (end of list)
+srv router skipped: local_parts mismatch
+--------> useryz router <--------
+local_part=userx domain=nonexist.example.com
+checking local_parts
+userx in "usery:userz"? no (end of list)
+useryz router skipped: local_parts mismatch
+--------> lookuphost router <--------
+local_part=userx domain=nonexist.example.com
+checking local_parts
+userx in "!userd"? yes (end of list)
+calling lookuphost router
+lookuphost router called for userx@nonexist.example.com
+  domain = nonexist.example.com
+DNS lookup of nonexist.example.com (MX) using fakens
+DNS lookup of nonexist.example.com (MX) gave HOST_NOT_FOUND
+returning DNS_NOMATCH
+ writing neg-cache entry for nonexist.example.com-MX-c1, ttl 2
+lookuphost router declined for userx@nonexist.example.com
+"more" is false: skipping remaining routers
+no more routers
+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+Testing userd@nonexist.example.com
+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+Considering userd@nonexist.example.com
+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+routing userd@nonexist.example.com
+--------> srv router <--------
+local_part=userd domain=nonexist.example.com
+checking local_parts
+userd in "^srv"? no (end of list)
+srv router skipped: local_parts mismatch
+--------> useryz router <--------
+local_part=userd domain=nonexist.example.com
+checking local_parts
+userd in "usery:userz"? no (end of list)
+useryz router skipped: local_parts mismatch
+--------> lookuphost router <--------
+local_part=userd domain=nonexist.example.com
+checking local_parts
+userd in "!userd"? no (matched "!userd")
+lookuphost router skipped: local_parts mismatch
+--------> delay router <--------
+local_part=userd domain=nonexist.example.com
+checking "condition" "${acl {delay}}"...
+  using ACL "delay"
+  processing "accept" (TESTSUITE/test-config 18)
+  check delay = 3s
+  delay modifier requests 3-second delay
+    message: y
+  accept: condition test succeeded in ACL "delay"
+  end of ACL "delay": ACCEPT
+calling delay router
+delay router called for userd@nonexist.example.com
+  domain = nonexist.example.com
+DNS lookup of nonexist.example.com-MX: cached value DNS_NOMATCH past valid time
+DNS lookup of nonexist.example.com (MX) using fakens
+DNS lookup of nonexist.example.com (MX) gave HOST_NOT_FOUND
+returning DNS_NOMATCH
+ update neg-cache entry for nonexist.example.com-MX-c1, ttl 2
+delay router declined for userd@nonexist.example.com
+"more" is false: skipping remaining routers
+no more routers
+search_tidyup called
+>>>>>>>>>>>>>>>> Exim pid=pppp (main) terminating with rc=2 >>>>>>>>>>>>>>>>
diff --git a/test/stderr/0277 b/test/stderr/0277
index c174db8f1..3d9490f72 100644
--- a/test/stderr/0277
+++ b/test/stderr/0277
@@ -18,6 +18,8 @@ looking up host name for V4NET.2.3.4
 DNS lookup of 4.3.2.V4NET.in-addr.arpa (PTR) using fakens
 DNS lookup of 4.3.2.V4NET.in-addr.arpa (PTR) gave HOST_NOT_FOUND
 returning DNS_NOMATCH
+DNS: no SOA record found for neg-TTL
+ writing neg-cache entry for 4.3.2.V4NET.in-addr.arpa-PTR-41, ttl -1
 LOG: host_lookup_failed MAIN
   no host name found for IP address V4NET.2.3.4
 sender_fullhost = [V4NET.2.3.4]
@@ -94,6 +96,8 @@ looking up host name for V4NET.10.11.12
 DNS lookup of 12.11.10.V4NET.in-addr.arpa (PTR) using fakens
 DNS lookup of 12.11.10.V4NET.in-addr.arpa (PTR) gave HOST_NOT_FOUND
 returning DNS_NOMATCH
+DNS: no SOA record found for neg-TTL
+ writing neg-cache entry for 12.11.10.V4NET.in-addr.arpa-PTR-41, ttl -1
 LOG: host_lookup_failed MAIN
   no host name found for IP address V4NET.10.11.12
 sender_fullhost = [V4NET.10.11.12]
@@ -137,6 +141,8 @@ looking up host name for V4NET.1.1.1
 DNS lookup of 1.1.1.V4NET.in-addr.arpa (PTR) using fakens
 DNS lookup of 1.1.1.V4NET.in-addr.arpa (PTR) gave HOST_NOT_FOUND
 returning DNS_NOMATCH
+DNS: no SOA record found for neg-TTL
+ writing neg-cache entry for 1.1.1.V4NET.in-addr.arpa-PTR-41, ttl -1
 LOG: host_lookup_failed MAIN
   no host name found for IP address V4NET.1.1.1
 sender_fullhost = [V4NET.1.1.1]
@@ -180,6 +186,8 @@ looking up host name for V4NET.2.2.2
 DNS lookup of 2.2.2.V4NET.in-addr.arpa (PTR) using fakens
 DNS lookup of 2.2.2.V4NET.in-addr.arpa (PTR) gave HOST_NOT_FOUND
 returning DNS_NOMATCH
+DNS: no SOA record found for neg-TTL
+ writing neg-cache entry for 2.2.2.V4NET.in-addr.arpa-PTR-41, ttl -1
 LOG: host_lookup_failed MAIN
   no host name found for IP address V4NET.2.2.2
 sender_fullhost = [V4NET.2.2.2]
diff --git a/test/stderr/0278 b/test/stderr/0278
index aafb854d5..6e2fa3558 100644
--- a/test/stderr/0278
+++ b/test/stderr/0278
@@ -291,9 +291,12 @@ r2 router called for unknown@test.ex
 DNS lookup of test.ex (MX) using fakens
 DNS lookup of test.ex (MX) gave NO_DATA
 returning DNS_NODATA
+ writing neg-cache entry for test.ex-MX-c1, ttl 3600
+ writing neg-cache entry for test.ex-AAAA-c1, ttl 3600
 DNS lookup of test.ex (A) using fakens
 DNS lookup of test.ex (A) gave NO_DATA
 returning DNS_NODATA
+ writing neg-cache entry for test.ex-A-c1, ttl 3600
 r2 router declined for unknown@test.ex
 --------> r3 router <--------
 local_part=unknown domain=test.ex
diff --git a/test/stderr/0361 b/test/stderr/0361
index 9b74af458..8846bea0f 100644
--- a/test/stderr/0361
+++ b/test/stderr/0361
@@ -99,10 +99,13 @@ r1 router called for kilos@recurse.test.ex
 DNS lookup of recurse.test.ex (MX) using fakens
 DNS lookup of recurse.test.ex (MX) gave HOST_NOT_FOUND
 returning DNS_NOMATCH
+ writing neg-cache entry for recurse.test.ex-MX-c1, ttl 3600
 r1 router widened recurse.test.ex to recurse.test.ex.test.ex
 DNS lookup of recurse.test.ex.test.ex (MX) using fakens
 DNS lookup of recurse.test.ex.test.ex (MX) gave NO_DATA
 returning DNS_NODATA
+ writing neg-cache entry for recurse.test.ex.test.ex-MX-c1, ttl 3600
+ writing neg-cache entry for recurse.test.ex.test.ex-AAAA-c1, ttl 3600
 DNS lookup of recurse.test.ex.test.ex (A) using fakens
 DNS lookup of recurse.test.ex.test.ex (A) succeeded
 fully qualified name = recurse.test.ex.test.ex
diff --git a/test/stderr/0381 b/test/stderr/0381
index 42b52d031..62a013753 100644
--- a/test/stderr/0381
+++ b/test/stderr/0381
@@ -41,12 +41,14 @@ DNS lookup of 97.99.99.V4NET.in-addr.arpa (PTR) using fakens
 DNS lookup of 97.99.99.V4NET.in-addr.arpa (PTR) succeeded
 IP address lookup yielded "x.gov.uk.test.ex"
   alias "x.co.uk.test.ex"
+ writing neg-cache entry for x.gov.uk.test.ex-AAAA-41, ttl 3600
 DNS lookup of x.gov.uk.test.ex (A) using fakens
 DNS lookup of x.gov.uk.test.ex (A) succeeded
 x.gov.uk.test.ex V4NET.99.99.97 mx=-1 sort=xx 
 checking addresses for x.gov.uk.test.ex
 Forward DNS security status: unverified
   V4NET.99.99.97 OK
+ writing neg-cache entry for x.co.uk.test.ex-AAAA-41, ttl 3600
 DNS lookup of x.co.uk.test.ex (A) using fakens
 DNS lookup of x.co.uk.test.ex (A) succeeded
 x.co.uk.test.ex V4NET.99.99.97 mx=-1 sort=xx 
diff --git a/test/stderr/0419 b/test/stderr/0419
index 8aba8f1e4..636015b10 100644
--- a/test/stderr/0419
+++ b/test/stderr/0419
@@ -24,8 +24,10 @@ dnslookup router called for k@mxt13.test.ex
   domain = mxt13.test.ex
 DNS lookup of mxt13.test.ex (MX) using fakens
 DNS lookup of mxt13.test.ex (MX) succeeded
+ writing neg-cache entry for other1.test.ex-AAAA-41, ttl 3600
 DNS lookup of other1.test.ex (A) using fakens
 DNS lookup of other1.test.ex (A) succeeded
+ writing neg-cache entry for other2.test.ex-AAAA-41, ttl 3600
 DNS lookup of other2.test.ex (A) using fakens
 DNS lookup of other2.test.ex (A) succeeded
 other1.test.ex in "!mxt13.test.ex : !other1.test.ex : *.test.ex"? no (matched "!other1.test.ex")
diff --git a/test/stderr/0463 b/test/stderr/0463
index 13b77a886..694d9df8b 100644
--- a/test/stderr/0463
+++ b/test/stderr/0463
@@ -19,6 +19,7 @@ checking domains
 DNS lookup of ten-1 (MX) using fakens
 DNS lookup of ten-1 (MX) gave NO_DATA
 returning DNS_NODATA
+ writing neg-cache entry for ten-1-MX-41, ttl 3600
 Address records are not being sought
 ten-1 in "!@mx_any"? yes (end of list)
 calling all router
@@ -27,6 +28,8 @@ all router called for x@ten-1
 DNS lookup of ten-1 (MX) using fakens
 DNS lookup of ten-1 (MX) gave NO_DATA
 returning DNS_NODATA
+ writing neg-cache entry for ten-1-MX-c1, ttl 3600
+ writing neg-cache entry for ten-1-AAAA-c1, ttl 3600
 DNS lookup of ten-1 (A) using fakens
 DNS lookup of ten-1 (A) succeeded
 fully qualified name = ten-1.test.ex
@@ -44,6 +47,7 @@ checking domains
 DNS lookup of ten-1.test.ex (MX) using fakens
 DNS lookup of ten-1.test.ex (MX) gave NO_DATA
 returning DNS_NODATA
+ writing neg-cache entry for ten-1.test.ex-MX-41, ttl 3600
 Address records are not being sought
 ten-1.test.ex in "!@mx_any"? yes (end of list)
 calling all router
@@ -52,6 +56,8 @@ all router called for x@ten-1.test.ex
 DNS lookup of ten-1.test.ex (MX) using fakens
 DNS lookup of ten-1.test.ex (MX) gave NO_DATA
 returning DNS_NODATA
+ writing neg-cache entry for ten-1.test.ex-MX-c1, ttl 3600
+ writing neg-cache entry for ten-1.test.ex-AAAA-c1, ttl 3600
 DNS lookup of ten-1.test.ex (A) using fakens
 DNS lookup of ten-1.test.ex (A) succeeded
 fully qualified name = ten-1.test.ex
diff --git a/test/stderr/0469 b/test/stderr/0469
index 919f65a47..9dae8fc14 100644
--- a/test/stderr/0469
+++ b/test/stderr/0469
@@ -25,6 +25,7 @@ fakens returned PASS_ON
 passing dontqualify on to res_search()
 DNS lookup of dontqualify (A) gave HOST_NOT_FOUND
 returning DNS_NOMATCH
+ writing neg-cache entry for dontqualify-A-41, ttl 86400
 fully qualified name = mxt1c.test.ex
 host_find_bydns yield = HOST_FIND_FAILED (0); returned hosts:
   dontqualify <null> MX=1 *
diff --git a/test/stderr/0545 b/test/stderr/0545
index a147fd976..50658a6ef 100644
--- a/test/stderr/0545
+++ b/test/stderr/0545
@@ -24,6 +24,7 @@ CNAME found: change to eximtesthost.test.ex
 DNS lookup of eximtesthost.test.ex (MX) using fakens
 DNS lookup of eximtesthost.test.ex (MX) gave NO_DATA
 returning DNS_NODATA
+ writing neg-cache entry for eximtesthost.test.ex-MX-c1, ttl 3600
 DNS lookup of alias-eximtesthost (A) using fakens
 DNS lookup of alias-eximtesthost (A) succeeded
 CNAME found: change to eximtesthost.test.ex
@@ -94,6 +95,7 @@ CNAME found: change to eximtesthost.test.ex
 DNS lookup of eximtesthost.test.ex (MX) using fakens
 DNS lookup of eximtesthost.test.ex (MX) gave NO_DATA
 returning DNS_NODATA
+ writing neg-cache entry for eximtesthost.test.ex-MX-c1, ttl 3600
 DNS lookup of alias-eximtesthost.test.ex (A) using fakens
 DNS lookup of alias-eximtesthost.test.ex (A) succeeded
 CNAME found: change to eximtesthost.test.ex
diff --git a/test/stderr/1006 b/test/stderr/1006
index 19cf90401..8d8771e9c 100644
--- a/test/stderr/1006
+++ b/test/stderr/1006
@@ -13,10 +13,12 @@ DNS lookup of 46.test.ex (A) succeeded
 DNS lookup of v6.test.ex (MX) using fakens
 DNS lookup of v6.test.ex (MX) gave NO_DATA
 returning DNS_NODATA
+ writing neg-cache entry for v6.test.ex-MX-c1, ttl 3600
 DNS lookup of v6.test.ex (AAAA) succeeded
 DNS lookup of v6.test.ex (A) using fakens
 DNS lookup of v6.test.ex (A) gave NO_DATA
 returning DNS_NODATA
+ writing neg-cache entry for v6.test.ex-A-c1, ttl 3600
 >>>>>>>>>>>>>>>> Exim pid=pppp (main) terminating with rc=0 >>>>>>>>>>>>>>>>
 Exim version x.yz ....
 configuration file is TESTSUITE/test-config
@@ -31,9 +33,11 @@ DNS lookup of 46.test.ex (A) succeeded
 DNS lookup of v6.test.ex (MX) using fakens
 DNS lookup of v6.test.ex (MX) gave NO_DATA
 returning DNS_NODATA
+ writing neg-cache entry for v6.test.ex-MX-c1, ttl 3600
 DNS lookup of v6.test.ex (A) using fakens
 DNS lookup of v6.test.ex (A) gave NO_DATA
 returning DNS_NODATA
+ writing neg-cache entry for v6.test.ex-A-c1, ttl 3600
 >>>>>>>>>>>>>>>> Exim pid=pppp (main) terminating with rc=2 >>>>>>>>>>>>>>>>
 
 ******** SERVER ********
diff --git a/test/stderr/2201 b/test/stderr/2201
index c7410cd7b..7e8d8a806 100644
--- a/test/stderr/2201
+++ b/test/stderr/2201
@@ -99,6 +99,7 @@ dnsdb key: unknown
 DNS lookup of unknown (TXT) using fakens
 DNS lookup of unknown (TXT) gave HOST_NOT_FOUND
 returning DNS_NOMATCH
+ writing neg-cache entry for unknown-TXT-41, ttl 3600
 lookup failed
 unknown in "dnsdb;unknown"? no (end of list)
 r1 router skipped: local_parts mismatch
diff --git a/test/stderr/2202 b/test/stderr/2202
index 66debc3d5..9543fb1b1 100644
--- a/test/stderr/2202
+++ b/test/stderr/2202
@@ -42,6 +42,8 @@ DNS lookup of cioce.test.again.dns (MX) using fakens
 DNS lookup of cioce.test.again.dns (MX) gave TRY_AGAIN
 cioce.test.again.dns in dns_again_means_nonexist? yes (matched "*")
 cioce.test.again.dns is in dns_again_means_nonexist: returning DNS_NOMATCH
+DNS: no SOA record found for neg-TTL
+ writing neg-cache entry for cioce.test.again.dns-MX-41, ttl -1
  lookup failed
 sender host name required, to match against *.cioce.test.again.dns
 looking up host name for ip4.ip4.ip4.ip4
@@ -62,6 +64,8 @@ DNS lookup of cioce.test.again.dns (A) using fakens
 DNS lookup of cioce.test.again.dns (A) gave TRY_AGAIN
 cioce.test.again.dns in dns_again_means_nonexist? yes (matched "*")
 cioce.test.again.dns is in dns_again_means_nonexist: returning DNS_NOMATCH
+DNS: no SOA record found for neg-TTL
+ writing neg-cache entry for cioce.test.again.dns-A-c1, ttl -1
 get[host|ipnode]byname[2] returned 1 (HOST_NOT_FOUND)
 no IP address found for host cioce.test.again.dns (during SMTP connection from the.local.host.name [ip4.ip4.ip4.ip4])
 LOG: host_lookup_failed MAIN
diff --git a/test/stderr/4802 b/test/stderr/4802
index 9575f881f..8f25c05f9 100644
--- a/test/stderr/4802
+++ b/test/stderr/4802
@@ -4,6 +4,7 @@ admin user
 dropping to exim gid; retaining priv uid
 DNS lookup of mx-sec-a-aa.test.ex (MX) using fakens
 DNS lookup of mx-sec-a-aa.test.ex (MX) succeeded
+ writing neg-cache entry for a-aa.test.ex-AAAA-800041, ttl 3600
 DNS lookup of a-aa.test.ex (A) using fakens
 DNS lookup of a-aa.test.ex (A) succeeded
 DNS lookup of a-aa.test.ex (A/AAAA) requested AD, but got AA
@@ -15,6 +16,7 @@ dropping to exim gid; retaining priv uid
 DNS lookup of mx-aa-a-sec.test.ex (MX) using fakens
 DNS lookup of mx-aa-a-sec.test.ex (MX) succeeded
 DNS lookup of mx-aa-a-sec.test.ex (MX) requested AD, but got AA
+ writing neg-cache entry for a-sec.test.ex-AAAA-800041, ttl 3600
 DNS lookup of a-sec.test.ex (A) using fakens
 DNS lookup of a-sec.test.ex (A) succeeded
 >>>>>>>>>>>>>>>> Exim pid=pppp (main) terminating with rc=0 >>>>>>>>>>>>>>>>
diff --git a/test/stderr/4803 b/test/stderr/4803
index a7aa7bfa8..dd4d99f0c 100644
--- a/test/stderr/4803
+++ b/test/stderr/4803
@@ -4,6 +4,7 @@ admin user
 dropping to exim gid; retaining priv uid
 DNS lookup of mx-sec-a-aa.test.ex (MX) using fakens
 DNS lookup of mx-sec-a-aa.test.ex (MX) succeeded
+ writing neg-cache entry for a-aa.test.ex-AAAA-800041, ttl 3600
 DNS lookup of a-aa.test.ex (A) using fakens
 DNS lookup of a-aa.test.ex (A) succeeded
 DNS faked the AD bit (got AA and matched with dns_trust_aa (test.ex in *))
@@ -19,6 +20,7 @@ DNS lookup of mx-aa-a-sec.test.ex (MX) succeeded
 DNS faked the AD bit (got AA and matched with dns_trust_aa (test.ex in *))
 DNS faked the AD bit (got AA and matched with dns_trust_aa (test.ex in *))
 DNS faked the AD bit (got AA and matched with dns_trust_aa (test.ex in *))
+ writing neg-cache entry for a-sec.test.ex-AAAA-800041, ttl 3600
 DNS lookup of a-sec.test.ex (A) using fakens
 DNS lookup of a-sec.test.ex (A) succeeded
 >>>>>>>>>>>>>>>> Exim pid=pppp (main) terminating with rc=0 >>>>>>>>>>>>>>>>
diff --git a/test/stdout/0183 b/test/stdout/0183
index 66b21e58a..9d8e53ff9 100644
--- a/test/stdout/0183
+++ b/test/stdout/0183
@@ -30,3 +30,5 @@ xyz@ten-1.test.ex
   host ten-1.test.ex [V4NET.0.0.1]
 srv@test.again.dns cannot be resolved at this time: host lookup did not complete
 srv@test.fail.dns cannot be resolved at this time: host lookup did not complete
+userx@nonexist.example.com is undeliverable: Unrouteable address
+userd@nonexist.example.com is undeliverable: Unrouteable address