{{ summaryTitle }} {{ summaryValue }} {{ summaryLine }} {{ badge.label }}: {{ badge.value }} {{ summaryAnnouncement }}
The profile changes operational guidance, not the capacity formula.
Use peak or busy-hour QPS from the same interval as hit and insert rates.
QPS
{{ formatPercent(cache_hit_rate_pct, 1) }}
Use measured hit rate or a clearly labeled target.
%
Estimate from cache-fill telemetry or sampled unique QNAME and RRtype churn.
/s
Use the observed mean retention window or the policy value being evaluated.
sec
Include RR data, names, metadata, and measured allocator overhead where available.
bytes
Model one resolver, view, container, or cache boundary at a time.
MiB
Use a measurement from the same resolver path as hit latency.
ms
Hit latency must not exceed miss latency in this planning model.
ms
{{ formatPercent(negative_response_pct, 0) }}
The model uses 45% of the positive footprint for each negative entry.
%
Use the resolver-capped negative retention window.
sec
Use 1.00 for no added DNSSEC allowance; calibrate with measured signed traffic.
Calibrate against a warmed resolver's resident memory and cache counters.
{{ formatPercent(reserve_pct, 0) }}
Applied after DNSSEC and cache-layer allowances.
%
{{ formatPercent(prefetch_refresh_pct, 0) }}
Use 0% when prefetch or stale-answer refresh is disabled or unmeasured.
%
{{ workflowFeedback }}
Leave blank for the generic tool name.
Use extra decimals when comparing close scenarios; this setting does not round the model.
MeasureValuePlanning meaningCopy
{{ row.label }}{{ row.value }}{{ row.context }}

{{ item.title }}

{{ item.text }}

DNS TTL Change Window Calculator Plan a DNS TTL cutover window from cache-drain and observation timing, including negative-cache checks and resolver refresh pressure.
DNS Propagation Checker Check DNS propagation across public resolvers, compare the intended record set, and identify cache holdouts with TTL and failure evidence.
EDNS Client Subnet (ECS) Tester Compare DNS answers with and without an EDNS Client Subnet hint, then inspect answer steering, echoed scope, TTL drift, and privacy clues.
DNS Delegation Trace Analyzer Trace a public hostname through DNS delegation and aliases, compare resolver views, and inspect DNSSEC or negative-cache clues.

Two recursive DNS resolvers can receive the same query rate and need very different cache sizes. A workload that repeatedly asks for a small set of names produces many reusable hits. Another workload may ask for a constant stream of unique or nonexistent names, filling the cache even when total queries per second are lower.

Cache memory follows the number of distinct answers retained during their time to live (TTL), not client query rate by itself. Each cached resource record set occupies space for record data, names, indexes, allocator overhead, and sometimes DNS Security Extensions (DNSSEC) material. Longer TTLs keep entries available for reuse, but they also keep more unique answers resident at the same time.

DNS queries splitting into cache hits and upstream misses while retained entries consume memory

Positive answers and negative answers need separate retention estimates. Negative caching stores the knowledge that a name or requested record type does not exist. Its TTL can differ from a positive answer's TTL, and a typo storm or automated scan can make negative entries a meaningful share of the cache even when each entry is smaller.

Cache hit rate
The share of client questions answered from cache without an ordinary upstream lookup.
Distinct insert rate
New cacheable answer sets added per second, after repeated questions are removed from the count.
Average footprint
Measured bytes per positive cached entry, including data and practical memory overhead available from telemetry.
Reserve headroom
Extra memory held above estimated operating occupancy for churn and measurement error.

Query rate and hit rate govern upstream traffic and blended latency. Insert rate, TTL, entry size, negative-answer share, and memory multipliers govern cache occupancy. Raising hit rate can reduce upstream work without shrinking memory when the retained hot set stays the same. Raising TTL can enlarge memory demand even if client traffic is unchanged.

A planning estimate becomes trustworthy only when its measurements describe the same resolver boundary and the same busy interval. Combining peak query rate from one day, hit rate from another, and an average entry size from a cold cache can produce a precise-looking number that does not describe any real operating state.

How to Use This Tool:

Model one resolver, view, container, or other cache boundary at a time with measurements from one representative interval.

  1. Choose the Resolver profile, then enter busy-period Client query rate, measured Cache hit rate, and Distinct cache inserts. The profile changes operational guidance rather than the equations, and total misses are not a substitute for unique inserts.
  2. Set positive and negative TTLs, the negative-answer share, and the average cached footprint. Use observed effective retention and memory counters where possible.
  3. Add DNSSEC, cache-layer, reserve, and prefetch multipliers only for overhead that is not already included in the measured footprint.
  4. Compare Required cache with Cache memory budget, then check upstream QPS and blended latency. If hit latency is greater than miss latency, correct the mismatched samples before continuing.

Interpreting Results:

Required cache includes estimated positive and negative entries, overhead multipliers, and reserve. Compare it with the memory assigned to the same cache boundary, not total host RAM.

  • Utilization at or below 85% is labeled Fits budget. Above 85% through 100% is a Close fit; above 100% is Budget short.
  • A positive Spare memory value does not reserve RAM for the operating system, packet buffers, workers, or unrelated daemon structures unless those costs were included in the budget.
  • Upstream QPS includes ordinary misses plus modeled prefetch refreshes. A high hit rate can still leave material upstream load at large client volumes.
  • Use the TTL curve to test memory sensitivity and the hit-rate curve to test upstream relief. Neither curve predicts workload changes caused by new applications or attack traffic.

Technical Details:

The memory model uses Little's-law-style occupancy: an arrival rate multiplied by average residence time estimates the number of resident entries. Positive and negative inserts are split by the negative-answer share and multiplied by their own TTLs. The repository-authored estimate treats each negative entry as 45% of the entered positive footprint before the two configurable overhead multipliers are applied.

Traffic calculations are independent of insert occupancy. Misses are the non-hit share of client QPS. Prefetch refresh is modeled as a percentage of miss QPS, and blended response latency is the hit-rate-weighted average of measured hit and miss latency.

Formula Core:

Percent fields are converted to fractions in these equations, and bytes are divided by 1,048,576 to report mebibytes.

Np=I×(1-n)×Tp Nn=I×n×Tn Mrequired=(Np×s+Nn×0.45×s)×mDNSSEC×mcache×(1+r)220 Qupstream=Q×(1-h)×(1+p) Laverage=h×Lhit+(1-h)×Lmiss
SymbolMeaningUnit
I, nDistinct inserts per second and negative shareentries/s and fraction
Tp, TnPositive and negative TTLseconds
sAverage positive cached footprintbytes/entry
mDNSSEC, mcache, rDNSSEC multiplier, cache-layer multiplier, and reserve fractionmultipliers
Q, h, pClient QPS, hit fraction, and prefetch fractionqueries/s and fractions

Using the default values, 180 inserts/s with an 8% negative share and a 1,800-second positive TTL produces 298,080 positive entries. The 900-second negative TTL produces 12,960 negative entries. After the 550-byte footprint, 1.25 DNSSEC multiplier, 1.35 cache-layer multiplier, and 25% reserve, required capacity is about 336.25 MiB.

Rule Core:

ConditionBoundaryResult
Hit-rate domain0% through 99.9%100% is rejected so a finite miss path remains in the model
Latency consistencyHit latency must be less than or equal to miss latencyA reversed pair blocks the result
Memory statusMore than 85% is close; more than 100% is shortExactly 85% still fits and exactly 100% is still a close fit
Insert-rate warningDistinct inserts exceed miss QPS by more than 20%Check telemetry definitions or interval mismatch
Policy warningsPositive TTL above 86,400 s or negative share above 40%Review freshness policy and negative-query churn

Accuracy Notes:

The equations model steady average occupancy. Real caches evict entries, cap TTLs, shard data, duplicate structures, garbage-collect memory, and experience bursts. Measure resident memory and cache counters after warm-up, then adjust the footprint and multipliers until the estimate explains observed behavior.

  • The 45% negative-entry footprint is a declared planning assumption, not a DNS standard.
  • The resolver profile does not substitute vendor-specific memory settings into the formula.
  • DNSSEC overhead should not be added twice when measured entry size already includes signed-answer and allocator costs.
  • Higher hit rate does not guarantee fresher answers; TTL and authoritative change timing still control cache reuse.

Worked Examples:

Busy cache that fits

At 12,000 client QPS and a 72% hit rate, ordinary misses are 3,360 QPS. Five percent prefetch overhead raises upstream load to 3,528 QPS. The default occupancy estimate requires about 336 MiB against a 512 MiB cache budget, leaving about 176 MiB of modeled spare capacity.

Longer retention exceeds the budget

A 3,600-second positive TTL, 50 inserts/s, 800 bytes per entry, and 128 MiB budget can require about 269 MiB after overhead and reserve. The negative spare value and 210% utilization make the memory shortfall explicit; raising the limit, reducing retention, or lowering churn must be evaluated with live counters.

References: