You changed an A record to point to a new server, but some users still reach the old one hours later. Why, and how should you plan a DNS change?

Users still reach the old server because the old answer is still cached. Every DNS answer has a TTL (time to live): the number of seconds it may be cached.

Many layers keep the old answer until its TTL runs out:

• recursive resolvers
• operating systems
• browsers
• some runtimes

So if a record has a TTL of 86400, users can reach the old IP for up to a day. "DNS propagation" is just these caches expiring at different times. Nothing is pushed out. Also, a few resolvers and clients cache longer than they should.

How to plan a DNS change:

• At least one old TTL before the change, lower the TTL to about 60 to 300 seconds.
• Make the change.
• Keep the old server running and working correctly until its traffic stops.
• Raise the TTL again afterwards.

Negative answers are cached too. Something may look up a name before the name exists. Then the NXDOMAIN answer ("this name does not exist") is cached. The zone's SOA record sets how long.