Concept
DNS resolution has two distinct roles that get conflated constantly: recursive resolvers (your ISP, 1.1.1.1, 8.8.8.8) do the legwork of walking the delegation chain on your behalf and cache the result; authoritative nameservers (your DNS provider) hold the actual source-of-truth record and never cache anything — they just answer. TTL (Time To Live) governs how long a recursive resolver is allowed to keep serving a cached answer before it must re-ask the authoritative source. Every layer between you and the authoritative server — your OS, your router, your ISP, a public resolver — can maintain its own independent cache with its own remaining TTL countdown.
DoH (DNS over HTTPS) and DoT (DNS over TLS) don't change any of this — they only encrypt the transport between you and your chosen recursive resolver, hiding your queries from local network observers (your ISP, a coffee-shop Wi-Fi operator) while the resolver itself still sees everything.
Common Misconception
"I changed the record, so it should be live everywhere now." No — every cache layer that already has the old answer will keep serving it until ITS copy of the TTL expires, independently of every other layer. "Propagation" isn't a single global event; it's dozens of independent, asynchronous cache expirations happening on their own schedules. A record can be correct at the authoritative server and simultaneously wrong from three different vantage points at once, and all three can be right.
Hands-On Exercise
No lab environment needed for this one — check propagation directly on marinadns.io:
- marinadns.io/prop — queries your domain from multiple resolver vantage points simultaneously and shows you exactly where the old vs. new answer is still cached. This is the fastest way to see the concept from this lesson without setting up anything.
- marinadns.io/dig — run a manual query against a specific resolver and read the TTL value directly in the response.
For the deeper terminal exercise (comparing recursive vs. authoritative answers, watching TTL count down in real time, and the DoH/DoT transport comparison), see Lesson 1 in the DNS Admin Course Lab Environment page — that part needs your own lab box or local terminal.
Commands to Run
# Query your own domain against your ISP/default resolver, note the TTL
dig yourdomain.com A
# Query the same record directly against a public resolver, compare TTL
dig @1.1.1.1 yourdomain.com A
dig @8.8.8.8 yourdomain.com A
# Query the authoritative nameserver directly (bypasses all caching)
dig @ns1.yourdnsprovider.com yourdomain.com A +norecurse
# Watch TTL count down: re-run the same query every 10s and compare the TTL field
watch -n 10 "dig @1.1.1.1 yourdomain.com A | grep -A1 ANSWER"
Change the A record's IP in your dashboard, then re-run the recursive query before and after the TTL expires — confirm you see the OLD value until TTL hits 0, then the NEW value.
Mastery Checkpoint
You should be able to explain, without looking anything up:
- Why two people querying the same domain from two different networks can legitimately see different answers at the same moment, with both being "correct."
- The difference between a resolver's cache TTL and your own OS's local DNS cache — two separate layers, two separate flush mechanisms.
- Why DoH/DoT improves query privacy but does nothing to change propagation timing.
If you can answer all three without re-reading this lesson, move to Lesson 2.
← DNS Admin Course Lab Environment
