Every DNS record carries a Time to Live, or TTL. It’s a number of seconds. It tells a resolver “you may reuse this answer for this long before asking again”.

Remaining, not original

Let’s look at a TTL from a recursive resolver:

dig @1.1.1.1 A flaviocopes.com +noall +answer

The number after the name is the TTL. Run the command again and it’s smaller. What you’re seeing is the remaining time in that resolver’s cache, not the value I configured.

When it hits zero, the resolver has to fetch a fresh copy before answering again. Some resolvers can serve stale data when the authoritative server is unreachable, but that’s a separate feature.

Short or long?

A short TTL, like 300 seconds, makes changes show up fast. It also limits how long a mistake stays cached. The price is more queries to your authoritative servers, and less protection if those servers go down.

A long TTL, like 86400 seconds (a day), means fewer queries and better resilience during outages. The price is a long transition window when you change something.

My habit: keep TTLs moderate day to day, and lower them before a planned change.

Lower the TTL early

Here’s the part people get wrong. Lowering a TTL does nothing for answers already cached with the old value.

Say the TTL is 86400 and you drop it to 300 five minutes before moving servers. A resolver that cached the old answer an hour ago still has 23 hours left. It won’t ask again until then. So lower the TTL at least one old-TTL before the move, then wait.

There’s no single “domain TTL”

Each record has its own TTL. A CNAME and the A record it points to can expire at different times. Negative answers get their own caching time from the zone’s SOA.

When you debug, look at the exact name and the exact record type. “The domain TTL” isn’t a thing.

Compare cache and authority

To see the real configured value, ask an authoritative server:

dig @1.1.1.1 A flaviocopes.com +noall +answer
authoritative_server=$(dig NS flaviocopes.com +short | head -n 1)
dig @"$authoritative_server" A flaviocopes.com +norecurse +noall +answer

Authority shows the current value and the full TTL. The recursive resolver may still show an old value with a countdown. That difference is caching, working as designed.

Try this: record the answer and TTL from authority and from two recursive resolvers, three times over a few minutes. Explain every difference you see without using the phrase “DNS propagation”.

TTL and cached answers