DNS Propagation (DNS Propagation)

Security Glossary - DNS

Definition: DNS propagation is the process by which DNS record changes spread across the global network of DNS resolvers and caches. After you update a DNS record, it takes time for all resolvers worldwide to pick up the new value because they cache records for the duration of the TTL (Time to Live).

Why DNS Propagation Matters

DNS propagation delays mean that DNS changes are not instant. After updating an A record to point to a new server, some visitors will still reach the old server until their resolver's cache expires. This creates a window where your site behaves differently for different visitors, which complicates server migrations.

The propagation time depends primarily on the TTL of the old cached answer. If the previous TTL was 86400 seconds, a resolver that cached it just before the change can keep that answer for nearly 24 hours. This is why planned migrations often lower the TTL at least one old-TTL interval before changing the record.

Negative caching, operating-system caches, applications, delegation changes, and resolver behavior can extend or alter the transition. There is no universal 48-hour ceiling. During a migration, keep the old and new services available long enough for measured traffic and DNS answers to converge.

How to Check

Use a DNS health checker or propagation checker that queries your DNS from multiple global locations. This shows which resolvers have picked up the new record and which still serve the old one. Comparing results from different regions reveals propagation progress.

Check DNS Health

Frequently Asked Questions

How can I speed up DNS propagation?
Lower the record's TTL before the change and wait at least one previous-TTL interval so old cached answers can expire. Choose a temporary TTL your provider and operational plan support, then raise it after you verify the migration.
Why do some users see the old site after a DNS change?
Their DNS resolver still has the old record cached. Until the cached TTL expires, the resolver serves the old IP address without checking the authoritative nameserver. Different resolvers received the old record at different times, so their caches expire at different times.
Key Takeaway: Before a planned change, lower the TTL at least one current-TTL interval in advance. After the change, verify the authoritative answer and observe several recursive resolvers before retiring the old service.
Disclaimer: DomainOptic provides automated informational scans only. Results do not constitute professional security advice, compliance certification, or a guarantee of security. Always verify findings independently.