How DNS Works: Lookups, Caching and TTL
Last updated: October 2026
What happens between typing a domain and reaching a server, why a DNS change takes time to show up, and what every record in a zone is for.
DNS turns a domain name into the addresses and settings behind it. A recursive resolver answers from its cache when it can; otherwise it follows the delegation from the root to the TLD to the domain's authoritative nameservers, which hold the zone. Every answer carries a TTL, and resolvers reuse it until that runs out, which is why a DNS change reaches different people at different times.
How a DNS lookup is answered
Five steps, most of which are skipped most of the time, because a cache already holds the answer.
-
Your device asks a resolver
A browser or mail server never walks the DNS itself. It hands the name to a recursive resolver: your ISP's, your network's, or a public one such as 1.1.1.1 or 8.8.8.8.
-
The resolver checks its cache
If it already holds an unexpired answer for that name and type, it returns it at once. Most lookups end here, which is why a change you just made can be invisible to you.
-
It walks the delegation chain
On a miss it asks a root server where the TLD lives, asks the TLD's servers which nameservers hold the domain, then asks those nameservers for the record. Each step is an NS delegation.
-
The authoritative server answers
The domain's own nameservers return the record from the zone, with a TTL. That server is the only one that holds the current truth; every other copy is a cache.
-
The answer is cached for its TTL
The resolver keeps the answer for the TTL it was given and serves it to everyone who asks until the timer runs out. A change propagates only as those caches expire.
Caching, TTL and propagation
DNS is fast because almost every answer is a copy. The same copies are why a change is never instant.
The authoritative nameservers have a new value the moment you save it. Every resolver that cached the old value keeps serving it until the TTL it was handed expires, and each resolver's timer started at a different moment. "Propagation" is that patchwork of caches expiring one by one.
The only lever you have is the TTL itself, and it works in advance: lower it on the records you are about to change a day before, make the change, then raise it again. Nameserver moves are slower, because the NS records that matter are cached from the parent zone with its own TTL.
- TTL (time to live)
- Time to live: how many seconds a resolver may cache a DNS answer before asking again. Set per record, and handed out with every answer.
- Wildcard DNS record
- A record whose name starts with an asterisk, such as *.example.com, that answers for any name under it that has no record of its own.
The record types in a zone
Each record type answers one question about a domain. Every entry links to its full definition.
- A record
- Maps a hostname to an IPv4 address. It is the record that answers "where is this website".
- AAAA record
- The IPv6 equivalent of an A record: it maps a hostname to an IPv6 address.
- CNAME record
- Aliases one name to another, so the resolver looks the second name up instead. Used to point a subdomain at a provider's hostname.
- MX record
- Names the mail servers that accept email for the domain, each with a priority number. The lowest number is tried first.
- NS record
- Names the authoritative nameservers for a zone. The registry publishes these for your domain, and they decide who answers every other question about it.
- TXT record
- Holds arbitrary text. It has no protocol meaning of its own, which is why so many systems use it to publish policy and verification strings.
- SOA record
- The start of authority: one record per zone, carrying the primary nameserver, the administrative contact and the timers that govern zone transfers and negative caching.
- CAA record
- Lists the certificate authorities permitted to issue certificates for the domain. A CA is required to check it before issuing.
- SRV record
- Advertises the hostname and port of a specific service for a domain, under a name that encodes the service and protocol.
- DS record
- The Delegation Signer record: a hash of your zone's signing key, published in the parent zone by the registry so a resolver can verify that the DNSSEC signatures in your zone are the right ones.
- DNS propagation
- The period after a DNS change during which some resolvers still answer with the old value, because they cached it before the edit.
Put this into practice
Look up any domain's records
Read every record type from the domain's authoritative nameservers, with its TTL.
Check DNS propagation
Compare one record across several public resolvers after a change.
Check email DNS
Read the MX, SPF, DKIM and DMARC records that decide whether mail arrives.
Get told when a record changes
DNS monitoring reads your zones on a schedule and alerts you with the old and new value.
Frequently asked questions
How does DNS work, in simple terms?
Your device asks a recursive resolver for a name. If the resolver has a fresh cached answer it returns it; if not, it asks a root server where the TLD is, asks the TLD which nameservers hold the domain, and asks those nameservers for the record. The answer comes back with a TTL, and the resolver reuses it until the TTL runs out.
What is the difference between a recursive resolver and an authoritative nameserver?
An authoritative nameserver holds a domain's zone and is the source of truth for its records. A recursive resolver holds nothing of its own: it looks answers up on your behalf and caches them. When you edit DNS you change the authoritative copy; the resolvers catch up as their cached copies expire.
Why is my DNS change not showing up?
Because a resolver you are using still holds the old answer, and will until the record's TTL expires. Check the record across several public resolvers: if the authoritative answer is new and some resolvers still return the old one, you are waiting on caches. If every resolver still shows the old value long after the TTL, the change was probably made in the wrong place, such as a DNS provider the domain no longer delegates to.
How long does a DNS change take?
Up to the old record's TTL, measured from when you saved the change, commonly between five minutes and an hour. A nameserver change can take up to the parent zone's TTL on the NS records, which is 48 hours for .com and .net.
What TTL should I use?
An hour (3600 seconds) is a sensible default for records that rarely change. Drop to 300 seconds a day before a planned change and raise it again afterwards. Very low TTLs everywhere cost more lookups and buy little, and very long ones make every mistake last longer.
Start Monitoring & Catching Domains Today
Join founders, agencies, and domainers already protecting their portfolio. Your first 5 domains are free.
No credit card required • Cancel anytime