NETWORK
DNS propagationWhy DNS changes take time to appear
"DNS propagation" is the period after a DNS record changes during which some resolvers still serve the old cached value. Nothing is pushed anywhere; each cache simply keeps the old record until its TTL expires. The delay is bounded by the old TTL plus any registrar or provider delays, and is commonly minutes to 48 hours.
What actually happens
DNS is pull-based. When you change a record at your DNS provider, the authoritative servers answer with the new value immediately. Every other resolver on the internet keeps whatever it cached until that record's TTL runs out, then asks again and receives the new value. The apparent "spread" of a change is just thousands of caches expiring at different moments.
Three layers of cache matter:
| Layer | Cleared by |
|---|---|
| Your browser and OS | ipconfig /flushdns, browser restart |
| Your recursive resolver (ISP, router, 1.1.1.1) | TTL expiry; you cannot flush it |
| Intermediate caches (corporate proxies, CDNs) | TTL expiry |
How long it takes
- A / CNAME / MX / TXT changes within a zone: as long as the old record's TTL. If the old TTL was 86400 (24 hours), some resolvers keep the old value for up to a day after the change.
- Nameserver changes at the registrar: the TLD zone's NS records typically have TTLs of one to two days, and registrars push changes to the registry on their own schedule. This is the source of the traditional "up to 48 hours" figure.
- New records (a name that did not exist before): fast, unless a resolver cached a negative answer, which is bounded by the zone's SOA minimum (negative-caching TTL).
Planning a change
- A day or two ahead, lower the TTL on the records you will change to 300 seconds.
- Wait for the old, long TTL to expire everywhere.
- Make the change; it now takes effect within five minutes.
- Raise the TTL back once stable.
Checking a change
Ask the authoritative servers directly to confirm the change is published:
nslookup -type=NS example.com
nslookup example.com ns1.provider.exampleThen compare what different resolvers see:
Resolve-DnsName example.com -Server 1.1.1.1
Resolve-DnsName example.com -Server 8.8.8.8
Resolve-DnsName example.comThe last command uses your normal resolver. When all three agree, propagation is complete for you. The DNS Lookup tool queries Cloudflare's resolver, which gives you one independent view.
Related failures
- A site showing the old server after migration: cached A record.
- 502 or certificate errors right after a change: some clients reach the new address while the new server is not yet configured for the name. See 502.
- Email still arriving at the old provider: cached MX records; keep the old mailbox alive for a day.
Frequently asked questions
Why can my friend see the new site but I cannot?
Your resolver (or your own PC) still has the old record cached; theirs has expired or never cached it. Flush your local cache and, if that does not help, wait for the resolver's cache to expire or temporarily use a different resolver.
Does flushing my DNS cache speed up propagation?
It clears your PC's cache only. Your resolver's cache is unaffected. Querying a different resolver (nslookup example.com 1.1.1.1) shows what that resolver has.
What TTL should I set?
A common practice: 3600 (1 hour) normally, lowered to 300 (5 minutes) a day before a planned change, then raised again afterwards. Very low TTLs increase query load on your authoritative servers.