DNS propagation: how long it really takes

DNS propagation refers to the delay between updating a DNS record and all systems being able to recognize the new information. Contrary to popular belief, DNS does not propagate in the traditional sense. Instead, it utilizes a pull-based approach. Modification to DNS records is not announced or pushed out to the world's resolvers.

Instead, individual systems, such as browsers, operating systems, or ISPs' resolvers, discover the change by querying for it. The specific moment of discovery is contingent on whether any part of the queried path still possesses a cached response, along with the TTL attached to that record. The TTL, or Time To Live, dictates how long the record remains cached before expiring.

The actual time for DNS propagation is largely determined by the TTL set on the record before alteration. The TTL specified in the change itself has minimal impact. By the time the change is implemented, all caches holding the old record are concurrently expiring the data. For example, if the TTL was originally set to 60 seconds and altered a day before, most visitors would see the new record within a minute or two.

Conversely, a default TTL of 3600 seconds would result in roughly an hour for the change to propagate. The quoted 24 to 48 hours is essentially a safety margin to account for the slowest cache in the propagation chain.

It's crucial to understand that you're not waiting in a queue. The perceived longer duration stems from the TTL values controlled by various parties along the DNS resolution path. The 24 to 48 hour recommendation persists due to this consideration for the slowest cache. In reality, the most critical action occurs a day prior to the migration, which involves lowering the TTL to 60 seconds at least 24 hours prior.

This allows all caches upstream to refresh more rapidly. Upon completing the switch, they retrieve the updated information within a brief timeframe, typically around a minute. If this prior step is overlooked, the DNS records remain on the old TTL, leaving no avenue to expedite the change after the fact.

A single DNS lookup traverses a chain of steps, with caches present at each juncture. These caches include the browser DNS cache (Chrome defaulting to approximately a minute), the OS DNS cache (with varying implementations), the local network resolver (such as a home router, office gateway, or ISP), and recursive resolution up the DNS hierarchy.

This journey typically takes milliseconds, culminating in the answer being cached for the duration specified by the TTL. Additionally, the use of DNS over HTTPS (DoH) or DNS over TLS (DoT) resolvers introduces yet another layer of caching, further impacting the propagation timeline.