DNS Propagation — Why Changes Take Time

DNS Propagation refers to the time it takes for DNS changes to be updated across all DNS servers worldwide. When you change a DNS record, the change is not immediately visible everywhere — various DNS resolvers still have the old answer cached.

Typical Propagation Times

Change Type	Typical Duration	Worst Case
A/AAAA record (low TTL)	5–30 minutes	4 hours
A/AAAA record (high TTL)	1–8 hours	48 hours
MX record	1–4 hours	24 hours
NS record / nameserver change	4–24 hours	48–72 hours
TXT record (SPF, DKIM, DMARC)	15 min – 2 hours	24 hours
New domain (first time)	Instant to 15 min	1 hour

Why Does It Take Time?

1. Caching: Every resolver caches responses until the TTL expires
2. TTL is decentralized: Each resolver has its own timer
3. Some ISPs ignore TTL: Some ISPs cache more aggressively than allowed
4. Negative caching: If the domain didn't exist before, the "does not exist" response is also cached

Before the Change

1. Lower TTL in advance: 2–4 hours before the planned change, set TTL to 300 (5 min). Wait for the old TTL to expire.
2. Make the planned change
3. Raise TTL back to normal after confirmation

After the Change

• Clear local cache:

# Windows
ipconfig /flushdns

# macOS  
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

# Linux (systemd)
sudo systemd-resolve --flush-caches

# Chrome Browser
chrome://net-internals/#dns → "Clear host cache"

• Query the authoritative NS directly:

dig @ns1.example.com example.com A

Command Line Tools

# Query different DNS resolvers directly
dig @8.8.8.8 example.com A          # Google DNS
dig @1.1.1.1 example.com A          # Cloudflare DNS
dig @9.9.9.9 example.com A          # Quad9 DNS

# Trace: Show the complete resolution path
dig +trace example.com A

Online Tools

• Provider.tools DNS Checker — Check DNS propagation worldwide
• dnschecker.org — Tests against 25+ global DNS servers
• whatsmydns.net — Simple propagation overview

What to Check

• Consistent responses: All resolvers should return the same value
• Check TTL values: If TTL is high, propagation will take longer
• NXDOMAIN responses: If some resolvers say "not found", propagation is not complete
• Authoritative server first: Always check your own NS first — is the value correct there?