Ask HN: Why does DNS propagation take less time now than before?

3 points·dj_mc_merlin··4 comments

It seems like it takes way less time nowadays for DNS records to propagate. I'm able to get an HTTPS cert seconds after making a record change. What changed?

View on HN

I discussed this ~7 months ago in comments to another article. https://news.ycombinator.com/item?id=23627864

Part of it seemed to be that I was querying an anycast server, the Google DNS server 8.8.8.8, which is probably many servers. So I wasn't hitting a cached entry because I was hitting a new server.

There are cache invalidation processes, the BIND name server has had one for ~20 years between authoritative servers. Google and Cloud Flare provide mechanisms for you to submit your own invalidation requests on a zone, and one could imagine a big provider like AWS doing that.

See the discussions in the above thread for more links to how to test and invalidate.

There will be many factors at play here. Cloud based providers may use their own protocol to sync between primary ns and ns1, ns2. Default TTLs might be shorter and caches may well cache for less time; also cache invalidation.

If you provide more information about the type of DNS server, who controls it, how it is managed and any default TTLs, perhaps people can help explain the shorter propagation period.

It’s a variety of factors. Lower TTLs are normal and respected by DNS servers. Caching is invalidated more intelligently. There are fewer mismanaged DNS implementations on local networks. Generally, computing has outpaced the demands of DNS.

Can you add more context around what you are doing such as the flow of DNS changes, what the TTL on the records were when you changed them and the process you are using to request a cert?

Reply on news.ycombinator.com