ComputeSphereLearn
Console
Learning paths / Cloud foundations / DNS

TTL, caching, and where you edit DNS

Reading · 6 min · Module 5, lesson 3 of 411 min left in this module

Module 5 · DNSLesson 3 of 4

Goal: Predict how long a DNS change takes to reach people, and find where a domain's records are really edited.

Key idea

Every DNS answer carries a TTL, the number of seconds a resolver may reuse it. A change reaches people only as their cached copies expire. And records only count where the domain's nameservers say they live, which may not be where you bought the domain.

TTL: how long old answers live

Say app.example.com has an A record with a TTL of 3600. A resolver that looked it up just before your change may keep serving the old address for up to an hour. Nothing is "propagating": old copies are simply expiring, one resolver at a time.

Planning a move? Lower the TTL to 300 a day ahead, make the change, then raise it again once things settle.

A cached "not found"

Resolvers remember that a name doesn't exist, too. If you looked up app.example.com before creating its record, your resolver may keep answering "not found" for as long as the domain's settings allow, often a few minutes. The record is fine and only your view is stale, so ask a different resolver to check.

Try it: look up a name, then look it up again.

dig +noall +answer example.com
dig @1.1.1.1 +noall +answer example.com

The second column is the TTL. Run the first line twice: it usually counts down, because your resolver is answering from its cache. The second line asks a different public resolver.

Registrar or DNS host?

Two jobs, often done by the same company:

  • The registrar is where you bought the domain and renew it. It tells the .com servers which nameservers the domain uses.
  • The DNS host runs those nameservers. Your records live there.

If you pointed the nameservers somewhere else, records you edit at the registrar are ignored. Before editing anything, check which nameservers are active:

dig NS example.com +short

On Windows: Resolve-DnsName example.com -Type NS. Edit your records at whoever runs the names it prints.

Check yourself

You changed an A record ten minutes ago. Its TTL was 3600. A friend still reaches the old server. What now?
You added a CNAME at your registrar, but dig still finds nothing, hours later. What do you check first?

In the docs