← Back to the library
OperationsCore · 6 min

A DNS change works for you but not for some users

“You updated a record. Your laptop sees the new IP, but some users and monitors still hit the old server, or a new subdomain returns NXDOMAIN for hours.”

ERROR CODES YOU MAY SEE

A code is a clue. Use its meaning and surrounding evidence to narrow the cause.

NXDOMAINDNS response codes · standard

Name Error (RCODE 3): the queried domain name does not exist.

Resolvers cache NXDOMAIN for the lesser of the SOA MINIMUM and the SOA TTL. A name queried before it was created can stay missing for that long after you add it.

Official reference for NXDOMAIN (opens in new tab)Code definition reviewed

THE PRINCIPLE

First confirm the authoritative servers give the new answer. After that, the delay is cache expiry, and you plan for it by lowering TTLs before the change, not after.

FIRST MOVES

  1. Query each authoritative nameserver directly (dig @ns +norecurse). If they disagree or still show the old value, the problem is your provider or a stale NS delegation, not caches.
  2. Check the delegation with dig +trace. After a provider move, the registrar's NS records decide which zone the world reads.
  3. Read the remaining TTL in a public resolver's answer (dig @1.1.1.1, @8.8.8.8). The countdown tells you when that cache expires.
  4. For a name that someone queried before it existed, the wait is the negative TTL: the lesser of SOA MINIMUM and the SOA record's TTL.
  5. Next time, lower the TTL at least one old-TTL period before the change. Keep the old target serving traffic until the old TTL has passed, and flush public resolver caches if you need to.

TOOLS: THEN → NOW

Online "propagation checkers" and waiting 48 hoursdig against the authoritative servers, then remaining TTLs on the resolvers your users actually use
Change the record and hopeLower the TTL ahead of time, keep old and new targets serving in parallel, then raise the TTL again

PATTERN SNAPSHOT

zone=example.com; name=api.example.com
# 1. Truth: every authoritative server, no recursion.
for ns in $(dig +short NS "$zone"); do
  echo "$ns: $(dig +short +norecurse @"$ns" "$name" A)"
done
# 2. Delegation from the root down (catches a stale registrar NS).
dig +trace "$name" A | tail -n 8
# 3. Caches: the second column is the remaining TTL in seconds.
dig +noall +answer @1.1.1.1 "$name" A
dig +noall +answer @8.8.8.8 "$name" A
# 4. Negative-caching TTL: min(SOA MINIMUM, SOA TTL).
dig +noall +answer SOA "$zone"

CLOSE THE AI. EXPLAIN THIS.

You lower a record's TTL from 86400 to 60 and change its IP five minutes later. How long might some users still see the old IP, and why?

HOW IT WORKS UNDERNEATH

SOURCES

Guide reviewed