Changed a DNS record and some people see the new value while others see the old one? That’s usually called DNS propagation. The word is misleading: nothing spreads. What happens is that caches expire.
What actually happens
When you change a record, the authoritative name server has the new value immediately. But every recursive resolver that asked earlier holds a cached copy and keeps using it until its TTL (time to live) runs out. Resolvers asked at different moments, so their copies expire at different moments. In between, some clients get the old answer and some the new one.
How long does it take?
At most the old TTL, counted from when each resolver last fetched the record. With a TTL of 3600 seconds, everyone is up to date within an hour; with 86,400 it can take a day. Two exceptions:
- NS changes (moving name servers) go through the delegation at the top-level domain and the TTL there.
- Negative answers (“doesn’t exist”) are cached for the SOA record’s minimum value.
Moving without downtime
- A day before: lower the TTL on the records you will change, to 300 seconds for example.
- Wait until the old, long TTL has passed.
- Change the records. Now it takes at most five minutes.
- Keep the old service running for a while, in case someone still has old answers.
- Raise the TTL again once everything is stable.
Check the status
- The DNS propagation check asks several large public resolvers at once and shows their answers and remaining TTLs.
- The DNS lookup shows what our resolver sees right now.
- The DNS comparison lines up two names, such as an old and a new domain.
When answers differ on purpose
CDNs and geo-DNS return different answers depending on where the question comes from. Differences between resolvers are then normal and don’t mean anything is stale. Check whether the name is a CNAME to a CDN.