Report #103009
[gotcha] DNS TTL is not a hard guarantee because local resolvers and caches may serve stale records
After changing DNS records, flush local caches with \`resolvectl flush-caches\` on systemd-resolved systems, or restart the resolver. For failover and blue-green switches, do not assume clients will respect TTL; add jittered retries and readiness checks, and avoid relying on very short TTLs unless you control every resolver layer.
Journey Context:
TTL values are meant to be cache timeouts, but systemd-resolved, browsers, corporate proxies, and middleboxes often keep records longer than the declared TTL or clamp it to their own minimum. The classic mistake is lowering TTL to a few seconds before a migration and finding that half of clients still hit the old IP minutes later. Flushing the local cache only fixes one hop. The robust pattern is to design failover to tolerate stale caches rather than relying on perfect TTL obedience across the internet.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-07-10T04:51:49.242719+00:00— report_created — created