Posted in

DNS TTL Definition: Why DNS Changes Take Time to Propagate

DNS TTL determines how long a DNS record can be cached before a resolver should retrieve a fresh version.

TTL means Time to Live, and it is one of the main reasons a DNS change may not appear everywhere immediately.

How does DNS TTL work?

Suppose your website currently points to:

192.0.2.10

Your A record has a DNS TTL of 3600 seconds, or one hour.

A recursive resolver looks up the domain and caches the answer. Ten minutes later, you change the record to a different IP address.

That resolver may continue returning its cached answer until the record’s remaining TTL expires. Once it needs the record again, it can request the newer value.

Longer TTL values can improve caching efficiency, while shorter TTL values allow changes to become visible more quickly.

Is that DNS propagation?

What people call DNS propagation is often really a collection of caches around the internet expiring at different times.

There isn’t a giant DNS update being pushed simultaneously to every computer on Earth.

Different resolvers may have cached the old record at different times, so one person might see your new server while another temporarily sees the old one.

Should you always use a low DNS TTL?

Not necessarily.

Lower TTL values mean resolvers need to request fresh answers more frequently. Higher TTL values provide more caching but make planned changes slower to appear.

For an upcoming migration, administrators often reduce the DNS TTL beforehand so cached records expire sooner. Once the migration is stable, the TTL can be increased again.

You should also remember that local caches and provider-specific behavior can affect exactly when you observe a change.

So the next time someone says, “The DNS hasn’t propagated yet,” check the TTL.

Very often, DNS isn’t broken.

It’s simply doing exactly what the cache was told to do.

Posted in

DNS over HTTPS Explained Simply

DNS over HTTPS encrypts DNS queries between your device and a compatible DNS resolver by sending those queries over HTTPS.

It is usually shortened to DoH.

Traditional DNS traffic can be visible to networks between you and your resolver. DNS over HTTPS changes that by carrying DNS requests inside an HTTPS connection protected by TLS. DoH is standardized in RFC 8484.

Why does DNS over HTTPS matter?

Suppose you visit:

example.com

Before connecting, your device usually needs to discover the site’s IP address.

With traditional unencrypted DNS, that lookup may be observable on the local network.

With DNS over HTTPS, the DNS request and response are encrypted while traveling between your device and the DoH resolver.

Does DoH make you anonymous?

No.

That’s one of the biggest misconceptions about DNS over HTTPS.

DoH protects DNS traffic in transit to the resolver, but the resolver itself can still process the domains you’re requesting. Standard DoH therefore should not be confused with an anonymity service.

Is DNS over HTTPS the same as DNSSEC?

No.

They solve different problems.

DoH protects the connection carrying the DNS query. DNSSEC helps verify the authenticity of DNS data.

The two technologies are independent and can work together. RFC 8484 specifically notes that using one does not remove the usefulness of the other.

For home users, DNS over HTTPS can provide greater protection against local DNS monitoring and tampering.

For companies, things become more complicated because organizations may rely on DNS visibility for filtering, security monitoring and internal services. Managed DoH deployments therefore need to fit the organization’s wider DNS strategy.

In simple terms: DNS over HTTPS doesn’t change what DNS does. It changes how your DNS question travels to the resolver.