How does TTL affect propagation time when I change records?

Here's something that trips people up all the time. You change a DNS record, then check it a few hours later and it's still showing the old value. You didn't do anything wrong. The old TTL is doing exactly what it was designed to do.

When you update a DNS record, resolvers around the world don't instantly ask for the new version. They just serve whatever they already cached, until the TTL countdown runs out. The TTL that controls how long that wait takes is the one that was set before you made the change. Not the new one you just saved.

So if your record had a TTL of 86400 seconds (24 hours), resolvers that cached it right before your change will serve the old value for up to 24 hours. There's nothing you can do to speed that up once it's cached. You have to wait it out.

This is why the smart move is to lower your TTL before you need to make a change. Here's the sequence that actually works:

1. Lower your TTL to 300 seconds (5 minutes) at least 48 hours before you plan to change the record.
2. Wait the full 48 hours. This ensures the old high TTL has expired from every resolver's cache.
3. Make your record change. It will now propagate in roughly 5 minutes instead of 24 hours.
4. Once you've confirmed everything's working, raise the TTL back to a sensible value (like 3600 or higher).

This matters a lot for email authentication. If you're rotating a DKIM key or updating an SPF record, a 24-hour gap between your change and full propagation means some receiving servers will be validating against the old record. That can cause temporary authentication failures, and in the worst case, messages get rejected or filtered until the new record fully propagates.

The takeaway is simple. TTL is a planning tool, not just a performance setting. If you know a change is coming, prep your TTL in advance and the whole thing becomes much less stressful.

Not sure what your current TTL values look like? You can check your SPF record with our free SPF Checker, or use the DKIM Record Lookup to see what's live in DNS right now.