How DNS propagation works

How long does it take?

There is no single “propagation time”. Every resolver that already has your old answer keeps it until its cached copy expires, which is the TTL (time to live) you set on the record. A resolver that has never seen your domain gets the new answer straight away.

So the wait is as long as the old record's TTL. If you change an A record whose TTL was 300 seconds, nearly everyone sees the new address within five minutes. If the TTL was 86400 (one day), some people may see the old address for a day. Changes to a domain's nameservers at the registrar are slower because the delegation is cached at the registry level, often for up to 48 hours.

What actually happens when you change a record

1. You edit the zoneAt your DNS provider, you change the record. The provider's authoritative nameservers start serving the new value, usually within seconds.
2. Resolvers keep their copyPublic and ISP resolvers that looked the record up earlier hold it in cache, along with the number of seconds they may keep it (the TTL, counting down).
3. A cache entry expiresWhen a resolver's copy runs out, the next query for that name triggers a fresh lookup, which returns the new value.
4. Everyone convergesEach resolver switches at its own moment, within one old TTL of the change. No data is “pushed” anywhere.

To see this live, query the authoritative nameservers and a public resolver side by side. The DNS propagation checker does it for many resolvers at once.

The layers that cache DNS

That is why “it works for me but not for them” happens in both directions after a change. See the flush commands in the propagation checker guide for clearing your own layers.

TTL: the setting that decides everything

TTL (time to live) is a number of seconds attached to every record. It tells caches how long they may reuse the answer: a TTL of 3600 means “you may keep this for an hour”. Long TTLs make your site faster and more resilient, and short ones make changes land quickly. You can have both, just not at the same time. Common values:

Lower TTLs mean quicker changes and more queries to your nameservers, which is rarely a problem at normal scale. Use the DNS lookup to read the TTL of any record.

Why nameserver changes feel slower

When you move a domain to a new DNS provider, you change the NS records at the registrar. The registry publishes them in the parent zone, for example .com, with a long TTL, commonly two days for .com. Resolvers that recently asked for your domain's nameservers keep using the old ones until that cache expires. During this window, some users reach the old provider and others the new.

• Copy the full zone first. Both providers should answer correctly for every record until the switch settles. Compare them with an NS and A lookup against each.
• Keep the old provider active for at least two days. Do not cancel it the same hour.
• Watch DNSSEC. A DS record at the registry that does not match the new provider's keys will make validating resolvers reject the domain. Remove it, or follow a coordinated procedure, before switching. See DS lookup.
• Check the registry's view. The WHOIS lookup shows the nameservers currently delegated.

New names and negative caching

Resolvers also cache the answer “this name does not exist” (NXDOMAIN) and “this type does not exist” (NODATA). RFC 2308 says that negative answers are cached for the lower of the SOA record's TTL and its last (minimum) field. If someone, or a monitoring system, looks up new.example.com a minute before you create it, resolvers may keep reporting NXDOMAIN for up to that long. The SOA lookup shows the value for your zone.

A safe plan for planned changes

1. Lower the TTL in advanceAt least one old-TTL before the change, set the TTL of the records you will change to 300 seconds. This is the step most people skip.
2. Make the changeUpdate the record. For a server move, keep the old server running.
3. Verify at the sourceQuery the authoritative nameservers directly to confirm the new value is published.
4. Watch the resolversUse the propagation checker to see public resolvers switch.
5. Clean upOnce everything has moved, restore a longer TTL and retire the old server.

# 1. What does the authoritative server say?
dig +norecurse @ns1.your-dns-provider.example www.example.com A

# 2. What does a public resolver say, and how long does it have left?
dig @1.1.1.1 www.example.com A

# 3. Which nameservers are delegated?
dig +short NS example.com

Special cases

• Email (MX). Sending servers cache MX records and may be mid-delivery to the old address. Keep the old mailbox alive for a few days.
• TXT verification. If a service cannot find your record, it is usually in the wrong place or not yet visible to that service's resolver. Retry after the TTL.
• CDN and geo-DNS. Different answers by location are intentional and not a sign of incomplete propagation.
• Registrar transfers. Moving a domain between registrars does not change DNS by itself. Only changing nameservers does.
• Long-running software. Some programs resolve names once at startup. Restart them after a change.