From 8a60245183ffa013097adbd895909abe2cea5c12 Mon Sep 17 00:00:00 2001
From: Andrey 0xdc09 <50486086+DarkCat09@users.noreply.github.com>
Date: Tue, 2 Jun 2026 10:04:32 +0000
Subject: [PATCH] fix(resolver): disable negative caching (#170)

---
 filtermail/src/utils.rs | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/filtermail/src/utils.rs b/filtermail/src/utils.rs
index 78d38ff5..f8a3ef64 100644
--- a/filtermail/src/utils.rs
+++ b/filtermail/src/utils.rs
@@ -1,8 +1,10 @@
+use hickory_resolver::config::ResolverOpts;
 use hickory_resolver::{TokioResolver, proto::dnssec::TrustAnchors};
 use mailparse::MailAddr;
 use std::path::PathBuf;
 use std::str::FromStr;
 use std::sync::Arc;
+use std::time::Duration;
 
 /// Extracts the first email address found in SMTP command or email header.
 ///
@@ -106,10 +108,14 @@ pub async fn log_eml(reason: &str, data: &[u8]) -> Result<PathBuf, crate::error:
 
 /// Creates a DNS resolver with DNSSEC enabled and system configuration (resolv.conf).
 pub fn build_resolver() -> Result<TokioResolver, crate::error::Error> {
-    let dns_resolver = TokioResolver::builder_tokio()?
+    let mut builder = TokioResolver::builder_tokio()?
         // https://github.com/hickory-dns/hickory-dns/issues/3519
-        .with_trust_anchor(Arc::new(TrustAnchors::default()))
-        .build()?;
+        .with_trust_anchor(Arc::new(TrustAnchors::default()));
+
+    // disable negative caching to prevent possible federation problems
+    builder.options_mut().negative_max_ttl = Some(Duration::ZERO);
+
+    let dns_resolver = builder.build()?;
 
     assert!(
         dns_resolver.options().validate,