DNS Lies for a While

Since the first I learned about DNS. I have always thought of it as a simple system that translates domain names into IP addresses. So it is somehow a lookup table/system (remind me of lookup integral tables in mathematics). But the reality is that DNS is also a memory system.

Before the era of LLM and tutorials everywhere on the internet (or before everyone using Cloudflare), the typical part that makes debugging annoying. You change an A record, fix a CNAME, remove a bad AAAA record, then test again and still get the old answer. Nothing is broken, exactly. Something remembered the previous answer and is obeying the TTL (Time To Live parameter).

The problem is that there is not one cache. Your browser may cache it (ctrl+shift+R on Firefox solved that). Your OS may cache it. Your router may cache it. Your recursive resolver may cache it. Some applications keep their own resolver state too. So when people say "DNS propagation", what they often mean is "old cached answers are dying at different times in different places."

Negative answers can also be cached. If a resolver learned that a name did not exist, it may keep that failure for a while. This is why creating a missing record does not always work instantly.

So the practical rule is simple: before changing DNS, lower the TTL. After changing it, test from more than one resolver.

For example:

dig example.com A @1.1.1.1
dig example.com A @9.9.9.9
dig example.com A @9.9.9.8

And when testing from your own machine, remember that you may not be asking the internet result. You may only be asking last resolver answer.