{"course":{"slug":"cloud-and-shipping","title":"Shipping It","url":"https://addaly.com/learn/cloud-and-shipping","level":"intermediate","track":"build"},"lesson":{"slug":"dns-and-domains","title":"Why your site is not loading","url":"https://addaly.com/learn/cloud-and-shipping/dns-and-domains","position":4,"of":74,"minutes":8,"answer":"Nothing propagates; DNS answers are cached for their TTL, so lower the TTL before you change anything.","keyIdea":"Nothing propagates; DNS answers are cached for their TTL, so lower the TTL before you change anything."},"body":{"format":"markdown","text":"## The name is a question, not an address\n\nBrowsers connect to IP addresses. `addaly.com` is not one. So before any connection happens, a chain of questions runs: your machine asks a resolver (your ISP's, or 1.1.1.1, or 8.8.8.8), which asks a root server, which points at the `.com` servers, which point at the **authoritative nameservers** for your domain, which finally give an answer.\n\nThe answer is a record:\n\n- **A**: an IPv4 address. `104.21.53.18`\n- **AAAA**: an IPv6 address.\n- **CNAME**: \"ask about this other name instead\".\n- **TXT**: arbitrary text, used to prove you own the domain.\n- **MX**: where mail goes.\n- **NS**: which nameservers are authoritative.\n\n## Two things people confuse, constantly\n\nThe **registrar** is who you bought the name from: Namecheap, Hostinger, GoDaddy. Roughly $11 or ₹900 a year for a `.com`.\n\nThe **nameservers** are who answers questions about it. These are often not the same company. If you moved your domain to Cloudflare, Cloudflare's nameservers answer, and the record editor back at your registrar is a form nobody reads. Editing there and waiting for a change that never comes is the single most common wasted afternoon in this subject.\n\n## Nothing propagates\n\n\"DNS propagation\" is a misleading phrase that has cost people days. Records are not pushed anywhere. They are pulled, and then cached, and every cache holds its copy for the record's **TTL**.\n\nIf your A record has a TTL of 3600, a resolver that asked five minutes ago will keep serving the old IP for another 55 minutes, no matter what you do. Your own machine may have asked more recently or less recently than a colleague's, which is why two people see two different sites.\n\nSo: **lower the TTL to 60 seconds the day before you plan a change.** Make the change, watch it take a minute instead of a day, then put the TTL back up.\n\n> Figure: How long a changed record can stay stale. Bars (minutes until the last cache lets go): TTL 86400 (a day) 1440; TTL 3600 (an hour) 60; TTL 300 5; TTL 60, set the day before 1. Nothing propagates. A resolver that asked one second before your change keeps the old answer for the whole TTL. Lower it to 60 the day before, change the record, then put it back up.\n\n## Ask the question yourself\n\nStop guessing from a browser. The browser adds its own caching, its own HTTPS upgrade, and its own error pages.\n\n```\n$ dig +short addaly.com\n$ dig +short addaly.com @1.1.1.1        # what a public resolver thinks\n$ dig +short addaly.com @ns1.example.com  # ask the authoritative server directly\n$ dig NS addaly.com +short              # who is authoritative at all\n```\n\nIf authoritative gives the new answer and 1.1.1.1 gives the old one, you are waiting on a TTL. Wait. If authoritative gives the old answer, your change did not save, or you edited a zone nobody consults.\n\n## Separate the three failures\n\nWhen \"the site is down\", it is one of these, and they need different fixes:\n\n1. **It does not resolve.** `dig` returns nothing. A DNS problem. Check nameservers, then records.\n2. **It resolves but does not connect.** You get the IP, the connection hangs or is refused. Firewall, wrong port, nothing listening.\n3. **It connects but the certificate is wrong.** The browser shows a security warning, not a 404. Your host has not issued a certificate yet, usually because it is waiting on the DNS to point at it. This is a TLS problem wearing a DNS costume.\n4. **Everything works and you get someone else's 404.** DNS is fine, TLS is fine, but the server does not recognise the hostname. You added the domain to DNS and forgot to add it to the application.\n\n## The apex quirk\n\nYou cannot put a CNAME on the bare domain (`example.com`) next to other records: the specification forbids it. That is why instructions always say \"CNAME for `www`, A record for the apex\". Providers work around it with ALIAS, ANAME, or CNAME flattening, which look like a CNAME to you and resolve to an A record for everyone else."},"check":{"question":"You moved hosts and updated the A record an hour ago. You see the new site. A colleague in Manila still sees the old one. From your terminal, `dig @1.1.1.1 yoursite.com` returns the new IP and `dig @8.8.8.8 yoursite.com` returns the old one. What is going on?","options":[{"text":"One resolver still holds the previous answer and will keep serving it until its copy of the TTL expires","correct":true},{"text":"The update has not reached Asian DNS servers yet; changes spread outward from the registrar over hours","correct":false,"tempting":"Treats DNS as a push system that copies records around the world, which is how the phrase 'propagation' makes it sound."},{"text":"Your colleague needs to clear their browser cache: the DNS is already consistent everywhere","correct":false,"tempting":"Blames the client cache, which genuinely does cause stale pages, while ignoring that dig bypasses the browser entirely and still disagrees."},{"text":"Two A records exist and traffic is being split between the old and new servers","correct":false,"tempting":"Reads two different answers as deliberate round-robin load balancing rather than one of them being out of date."}]},"prev":{"slug":"processes-that-restart-themselves","title":"What keeps your process running when you close the laptop","url":"https://addaly.com/learn/cloud-and-shipping/processes-that-restart-themselves"},"next":{"slug":"http-and-status-codes","title":"What a status code is telling you","url":"https://addaly.com/learn/cloud-and-shipping/http-and-status-codes"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'Why your site is not loading', in Shipping It. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/cloud-and-shipping/dns-and-domains (Accessed: 31 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"Why your site is not loading","courseTitle":"Shipping It","module":{"index":1,"slug":"how-the-internet-reaches-you","title":"How the internet reaches your process"},"answer":null,"keyIdea":"Nothing propagates; DNS answers are cached for their TTL, so lower the TTL before you change anything.","hero":{"kind":"figure","figure":{"t":"figure","label":"Figure","figure":{"type":"bars","unit":"minutes until the last cache lets go","title":"How long a changed record can stay stale","series":[{"label":"TTL 86400 (a day)","value":1440},{"label":"TTL 3600 (an hour)","value":60},{"label":"TTL 300","value":5},{"label":"TTL 60, set the day before","value":1,"highlight":true}],"caption":"Nothing propagates. A resolver that asked one second before your change keeps the old answer for the whole TTL. Lower it to 60 the day before, change the record, then put it back up."},"alt":"Figure: How long a changed record can stay stale. Bars (minutes until the last cache lets go): TTL 86400 (a day) 1440; TTL 3600 (an hour) 60; TTL 300 5; TTL 60, set the day before 1. Nothing propagates. A resolver that asked one second before your change keeps the old answer for the whole TTL. Lower it to 60 the day before, change the record, then put it back up."}},"blocks":[{"t":"h2","id":"the-name-is-a-question-not-an-address","runs":[{"text":"The name is a question, not an address"}]},{"t":"p","runs":[{"text":"Browsers connect to IP addresses. "},{"text":"addaly.com","code":true},{"text":" is not one. So before any connection happens, a chain of questions runs: your machine asks a resolver (your ISP’s, or 1.1.1.1, or 8.8.8.8), which asks a root server, which points at the "},{"text":".com","code":true},{"text":" servers, which point at the "},{"text":"authoritative nameservers","b":true},{"text":" for your domain, which finally give an answer."}]},{"t":"p","runs":[{"text":"The answer is a record:"}]},{"t":"ul","items":[[{"text":"A","b":true},{"text":": an IPv4 address. "},{"text":"104.21.53.18","code":true}],[{"text":"AAAA","b":true},{"text":": an IPv6 address."}],[{"text":"CNAME","b":true},{"text":": “ask about this other name instead”."}],[{"text":"TXT","b":true},{"text":": arbitrary text, used to prove you own the domain."}],[{"text":"MX","b":true},{"text":": where mail goes."}],[{"text":"NS","b":true},{"text":": which nameservers are authoritative."}]]},{"t":"h2","id":"two-things-people-confuse-constantly","runs":[{"text":"Two things people confuse, constantly"}]},{"t":"p","runs":[{"text":"The "},{"text":"registrar","b":true},{"text":" is who you bought the name from: Namecheap, Hostinger, GoDaddy. Roughly $11 or ₹900 a year for a "},{"text":".com","code":true},{"text":"."}]},{"t":"p","runs":[{"text":"The "},{"text":"nameservers","b":true},{"text":" are who answers questions about it. These are often not the same company. If you moved your domain to Cloudflare, Cloudflare’s nameservers answer, and the record editor back at your registrar is a form nobody reads. Editing there and waiting for a change that never comes is the single most common wasted afternoon in this subject."}]},{"t":"h2","id":"nothing-propagates","runs":[{"text":"Nothing propagates"}]},{"t":"p","runs":[{"text":"“DNS propagation” is a misleading phrase that has cost people days. Records are not pushed anywhere. They are pulled, and then cached, and every cache holds its copy for the record’s "},{"text":"TTL","b":true},{"text":"."}]},{"t":"p","runs":[{"text":"If your A record has a TTL of 3600, a resolver that asked five minutes ago will keep serving the old IP for another 55 minutes, no matter what you do. Your own machine may have asked more recently or less recently than a colleague’s, which is why two people see two different sites."}]},{"t":"p","runs":[{"text":"So: "},{"text":"lower the TTL to 60 seconds the day before you plan a change.","b":true},{"text":" Make the change, watch it take a minute instead of a day, then put the TTL back up."}]},{"t":"h2","id":"ask-the-question-yourself","runs":[{"text":"Ask the question yourself"}]},{"t":"p","runs":[{"text":"Stop guessing from a browser. The browser adds its own caching, its own HTTPS upgrade, and its own error pages."}]},{"t":"code","lang":"","label":"Text","text":"$ dig +short addaly.com\n$ dig +short addaly.com @1.1.1.1        # what a public resolver thinks\n$ dig +short addaly.com @ns1.example.com  # ask the authoritative server directly\n$ dig NS addaly.com +short              # who is authoritative at all"},{"t":"p","runs":[{"text":"If authoritative gives the new answer and 1.1.1.1 gives the old one, you are waiting on a TTL. Wait. If authoritative gives the old answer, your change did not save, or you edited a zone nobody consults."}]},{"t":"h2","id":"separate-the-three-failures","runs":[{"text":"Separate the three failures"}]},{"t":"p","runs":[{"text":"When “the site is down”, it is one of these, and they need different fixes:"}]},{"t":"ol","start":1,"items":[[{"text":"It does not resolve.","b":true},{"text":" "},{"text":"dig","code":true},{"text":" returns nothing. A DNS problem. Check nameservers, then records."}],[{"text":"It resolves but does not connect.","b":true},{"text":" You get the IP, the connection hangs or is refused. Firewall, wrong port, nothing listening."}],[{"text":"It connects but the certificate is wrong.","b":true},{"text":" The browser shows a security warning, not a 404. Your host has not issued a certificate yet, usually because it is waiting on the DNS to point at it. This is a TLS problem wearing a DNS costume."}],[{"text":"Everything works and you get someone else’s 404.","b":true},{"text":" DNS is fine, TLS is fine, but the server does not recognise the hostname. You added the domain to DNS and forgot to add it to the application."}]]},{"t":"h2","id":"the-apex-quirk","runs":[{"text":"The apex quirk"}]},{"t":"p","runs":[{"text":"You cannot put a CNAME on the bare domain ("},{"text":"example.com","code":true},{"text":") next to other records: the specification forbids it. That is why instructions always say “CNAME for "},{"text":"www","code":true},{"text":", A record for the apex”. Providers work around it with ALIAS, ANAME, or CNAME flattening, which look like a CNAME to you and resolve to an A record for everyone else."}]}],"check":{"question":[{"text":"You moved hosts and updated the A record an hour ago. You see the new site. A colleague in Manila still sees the old one. From your terminal, "},{"text":"dig @1.1.1.1 yoursite.com","code":true},{"text":" returns the new IP and "},{"text":"dig @8.8.8.8 yoursite.com","code":true},{"text":" returns the old one. What is going on?"}],"options":[{"text":[{"text":"One resolver still holds the previous answer and will keep serving it until its copy of the TTL expires"}],"correct":true,"tempting":null},{"text":[{"text":"The update has not reached Asian DNS servers yet; changes spread outward from the registrar over hours"}],"correct":false,"tempting":[{"text":"Treats DNS as a push system that copies records around the world, which is how the phrase ‘propagation’ makes it sound."}]},{"text":[{"text":"Your colleague needs to clear their browser cache: the DNS is already consistent everywhere"}],"correct":false,"tempting":[{"text":"Blames the client cache, which genuinely does cause stale pages, while ignoring that dig bypasses the browser entirely and still disagrees."}]},{"text":[{"text":"Two A records exist and traffic is being split between the old and new servers"}],"correct":false,"tempting":[{"text":"Reads two different answers as deliberate round-robin load balancing rather than one of them being out of date."}]}],"order":[1,0,2,3],"why":null},"prev":{"slug":"processes-that-restart-themselves","title":"What keeps your process running when you close the laptop","minutes":9},"next":{"slug":"http-and-status-codes","title":"What a status code is telling you","minutes":7}}}