How long does DNS propagation take?

You've just updated your SPF record, or added a new DKIM key, and now you're waiting. But how long do you actually have to wait before it works?

The honest answer is: it depends on your TTL setting. TTL (Time To Live) tells every DNS resolver on the internet how long to cache your record before checking for updates. When you change a DNS record, the old version keeps circulating until all those caches expire.

Here's how TTL maps to real wait times:

• Low TTL (300 seconds / 5 minutes): Most resolvers see the change within 5 to 30 minutes. This is the fastest you can realistically expect.
• Standard TTL (3600 seconds / 1 hour): Most places see the update within 1 to 4 hours. This is the most common default.
• High TTL (86400 seconds / 24 hours): Full propagation can take 24 to 48 hours. This is the "worst case" people warn you about.

Why does this matter for email specifically? If you're deploying or changing SPF, DKIM, or DMARC records, mailbox providers won't validate them correctly until they've pulled the new version. Send during that window and you risk authentication failures, which can push your mail toward spam folders.

One practical tip: before you make any major DNS change, drop your TTL to 300 seconds and wait for the current TTL to expire first. That way, if something goes wrong, you can fix it quickly without waiting another 24 hours for the correction to spread. Once you've confirmed the new record is working, bump the TTL back up to something sensible like 3600 seconds.

To check whether your changes have propagated, our free SPF checker or DKIM record lookup will query live DNS and show you exactly what resolvers are seeing right now. If you're mid-migration and things aren't resolving the way you expect, our SOS hotline is free and we actually pick up.