When Does a DNS TTL Change Take Effect?

Changing a DNS record and moving every client to a new address are separate events. An authoritative server may publish the new answer while recursive resolvers, operating systems or applications still use older information. Diagnose which component returns which answer instead of treating “propagation” as a single timer.

A lower TTL does not rewrite existing cache entries

If an A record was previously retrieved with a TTL of 86400 seconds, a resolver may retain that copy under its original lifetime. Setting the authoritative TTL to 300 at migration time does not retroactively reduce that cached copy to five minutes. Under normal conditions, lower it at least the old TTL in advance so subsequently cached answers use the shorter lifetime.

One record's TTL is not the lifetime of the entire lookup chain. A, AAAA and CNAME records can have separate lifetimes; nameserver and delegation changes involve other caches. This guide mainly concerns changing an existing address record. RFC 1035 defines the resource-record format.

Compare authoritative and recursive answers

With dig installed, substitute your own domain and actual authoritative server. example.com and ns1.example.net are placeholders; replace the second-line server using real NS information:

dig example.com NS +short
dig @ns1.example.net example.com A +norecurse
dig @1.1.1.1 example.com A
dig @8.8.8.8 example.com A

Check the authoritative answer's aa flag, response status and expected record. Query all authoritative servers; if only one is updated, caching may not be the only issue. Split DNS or geographic policy can intentionally produce different answers. The BIND dig reference documents the options.

Interpreting a displayed TTL

This is an illustrative recursive response:

example.com. 217 IN A 203.0.113.20

The answer advertises 217 seconds of remaining TTL. An authoritative answer's TTL should not be interpreted as the same cache countdown. A recursive value need not decrease continuously across your queries: refresh, prefetch or different cache nodes can change the observation. When authoritative service is unavailable, some resolvers can use serve-stale behavior. One displayed value is not a precise worldwide completion deadline.

A new name may have a cached negative answer

A previous NXDOMAIN response can be cached too. Reducing the new positive record's TTL does not remove the older negative entry. SOA information participates in the negative lifetime defined by RFC 2308. Do not classify SERVFAIL as merely a TTL wait; investigate issues such as authoritative reachability or DNSSEC validation.

When DNS is correct but the application still uses the old service

Flushing a device's local cache does not flush the provider's resolver. A browser may use its own secure-DNS service, and applications may cache answers or reuse open connections. An old AAAA record can also send IPv6 traffic elsewhere while the A record looks correct.

Keep the old service available for a controlled transition period, verify real application requests at the new endpoint and inspect logs for remaining traffic. Before restoring the normal TTL policy, separately confirm authoritative consistency, the answers from resolvers actually in use and successful application access to the new service.