DNS: negative cache behind a local resolver

♠ Problem statement: a newly created Route 53 record resolved through public DNS, but Chrome Brave and macOS still returned DNS_PROBE_POSSIBLE. It smells like a DNS caching issue. Flushing mDNSResponder did nothing though. The system resolver was Tailscale’s local DNS proxy, so I asked that resolver rather than trusting dig’s default path: % dig +time=3 +tries=1 @100.100.100.100 kargo.tools.example-corp.net A +noall +answer +authority +comments ; <<>> DiG 9.10.6 <<>> +time=3 +tries=1 @100.100.100.100 kargo.tools.example-corp.net A +noall +answer +authority +comments ; (1 server found) ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 13683 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; AUTHORITY SECTION: tools.example-corp.net. 225 IN SOA ns-1609.awsdns-09.co.uk. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 Route 53’s authoritative nameserver and several public resolvers already had it: % for resolver in 1.1.1.1 1.1.1.2 8.8.8.8; do printf '%-16s '…