[[networkaddress-cache-ttl]]
=== DNS cache settings

Elasticsearch runs with a security manager in place. With a security manager in
place, the JVM defaults to caching positive hostname resolutions indefinitely
and defaults to caching negative hostname resolutions for ten
seconds. Elasticsearch overrides this behavior with default values to cache
positive lookups for sixty seconds, and to cache negative lookups for ten
seconds. These values should be suitable for most environments, including
environments where DNS resolutions vary with time. If not, you can edit the
values `es.networkaddress.cache.ttl` and `es.networkaddress.cache.negative.ttl`
in the <<jvm-options,JVM options>>. Note that the values
https://docs.oracle.com/javase/8/docs/technotes/guides/net/properties.html[`networkaddress.cache.ttl=<timeout>`]
and
https://docs.oracle.com/javase/8/docs/technotes/guides/net/properties.html[`networkaddress.cache.negative.ttl=<timeout>`]
in the
https://docs.oracle.com/javase/8/docs/technotes/guides/security/PolicyFiles.html[Java
security policy] are ignored by Elasticsearch unless you remove the settings for
`es.networkaddress.cache.ttl` and `es.networkaddress.cache.negative.ttl`.