HACKER Q&A
📣 dj_mc_merlin

Why does DNS propagation take less time now than before?


It seems like it takes way less time nowadays for DNS records to propagate. I'm able to get an HTTPS cert seconds after making a record change. What changed?


  👤 linsomniac Accepted Answer ✓
I discussed this ~7 months ago in comments to another article. https://news.ycombinator.com/item?id=23627864

Part of it seemed to be that I was querying an anycast server, the Google DNS server 8.8.8.8, which is probably many servers. So I wasn't hitting a cached entry because I was hitting a new server.

There are cache invalidation processes, the BIND name server has had one for ~20 years between authoritative servers. Google and Cloud Flare provide mechanisms for you to submit your own invalidation requests on a zone, and one could imagine a big provider like AWS doing that.

See the discussions in the above thread for more links to how to test and invalidate.


👤 beermonster
There will be many factors at play here. Cloud based providers may use their own protocol to sync between primary ns and ns1, ns2. Default TTLs might be shorter and caches may well cache for less time; also cache invalidation.

If you provide more information about the type of DNS server, who controls it, how it is managed and any default TTLs, perhaps people can help explain the shorter propagation period.


👤 1123581321
It’s a variety of factors. Lower TTLs are normal and respected by DNS servers. Caching is invalidated more intelligently. There are fewer mismanaged DNS implementations on local networks. Generally, computing has outpaced the demands of DNS.

👤 LinuxBender
Can you add more context around what you are doing such as the flow of DNS changes, what the TTL on the records were when you changed them and the process you are using to request a cert?