SpeedDrain
DNS TTL Science · Zero-Downtime Migration · Recursive Resolver Caching · Dig CLI

DNS Propagation & TTL Migration Estimator

Model how long your DNS record changes take to update across global recursive resolvers. Plan seamless server cutovers and eliminate stale traffic outages.

Common Cutover Scenarios:
Expected Global Cache Clearance1.0 hrs

Based on active TTL of 3,600 seconds

Pre-Migration TTL Lowering Window1 hour(s)

Lower TTL to 300s this far in advance of actual IP cutover

Worst-Case Long Tail (All Caches)~1.2 hrs

Includes rebellious mobile operator caching & negative caching

Estimated Adoption Curve Across Global Resolvers

10%+6m

Tier 1 public resolvers query authoritative

50%+30m

Majority of high-traffic consumer ISPs refreshed

90%+54m

Nearly all regional resolvers expired

100%+60m

Original authoritative TTL completely lapsed

99.9%+74m

Edge cases & stubborn mobile carrier caches expired

Tier-by-Tier Resolver Propagation Behavior

How major DNS networks handle your TTL
Resolver NetworkIP EndpointGeographyTTL ComplianceInstant Cache Flush
Cloudflare 1.1.1.11.1.1.1Global AnycastStrict (RFC Compliant)Flush 1.1.1.1 Cache →
Google Public DNS8.8.8.8Global AnycastStrict (RFC Compliant)Flush Google Cache →
Quad9 DNS9.9.9.9Global Anycast (Anycast)Strict (RFC Compliant)
Cisco OpenDNS208.67.222.222Global AnycastStrict (RFC Compliant)
Comcast / Xfinity75.75.75.75North America (ISP)Standard
Deutsche Telekom194.25.0.60Europe (ISP)Standard
NTT Communications129.250.35.250Asia-Pacific (ISP)Standard
Mobile / Cellular GatewaysCarrier InternalGlobal 4G/5G NetworksClamped Minimum (Mobile)

Terminal Verification & Dig Diagnostic Commands

Query Default Authoritative Server:
dig api.speed-drain.com A +noall +answer +comments
Query Google Public DNS (8.8.8.8):
dig @8.8.8.8 api.speed-drain.com A +noall +answer
Query Cloudflare DNS (1.1.1.1):
dig @1.1.1.1 api.speed-drain.com A +noall +answer

Mastering DNS Propagation: Why "24-48 Hours" is Usually a Myth

01.The Reality of DNS "Propagation"

Technically, DNS records do not actively "propagate" or push themselves across the globe.

When you update an IP address on your authoritative nameserver (e.g. Cloudflare, Route 53), the change takes effect at the source in under 5 seconds.

What people describe as "propagation delay" is actually passive cache expiration. When a recursive resolver (like Comcast or Google 8.8.8.8) queried your domain 10 minutes ago, it saved the answer with a timer equal to your Time-To-Live (TTL). Until that cached timer counts down to 0, that resolver will not ask your authoritative nameserver again.

02.The 4-Step Zero-Downtime Migration Playbook

To migrate a production web app to a new server without dropping user traffic:

  1. Step 1 (T minus 48 Hours): Lower your record TTL from 86,400s (24h) or 3,600s (1h) down to 300 seconds (5 min).
  2. Step 2 (Wait Full Old TTL Window): Allow all global resolvers currently holding the old 24h cache to naturally expire and re-cache the new 300s TTL.
  3. Step 3 (Cutover Night): Update the record to point to your new server IP. Because the TTL is now only 300s, 99% of global traffic will switch over in 5 minutes!
  4. Step 4 (T plus 24 Hours): Once verified stable, raise the TTL back up to 3,600s or 86,400s to reduce DNS query load on your authoritative nameservers.

03.Why Some Resolvers Disobey TTL (The Rogue Caches)

RFC 1035 mandates that resolvers respect the TTL provided by authoritative nameservers. However, in practice:

  • Cellular Mobile Operators: Some 4G/5G mobile carriers clamp a minimum TTL threshold (e.g. 15–60 minutes) to save radio tower signaling traffic.
  • Client-Side OS Caching: Windows DNS Client service (ipconfig /flushdns) and macOS (dscacheutil -flushcache) maintain their own internal caches.
  • Browser Internal Caching: Chrome and Firefox cache resolved IP addresses in memory for up to 60 seconds independent of system DNS.

04.Negative Caching (SOA Minimum TTL)

If a user visits your website before you create the DNS record, the resolver receives an NXDOMAIN (non-existent domain) response.

Per RFC 2308, resolvers cache this failure! The duration of negative caching is defined by the last number in your zone's SOA (Start of Authority) record, typically between 300 and 86,400 seconds.

If you publish a new subdomain and wonder why your coworker cannot resolve it, their resolver is likely honoring this negative cache timer.