Blog

Changing DNS Without Downtime: TTL Strategy, Moving Nameservers, DNSSEC and DNS as Code

DNS doesn't propagate, resolvers cache: to change a record without downtime you lower the TTL at least one old TTL in advance, make the change and keep the old target running until its logs go quiet. In a lab we watch a resolver cache and negative caching second by second, switch providers with DNSSEC on and get SERVFAIL from the stale DS, compare going insecure with a multi-signer move, and manage the zone as code with DNSControl.