What is DNS caching, and why can an old answer remain visible?¶
title: "What is DNS caching, and why can an old answer remain visible?" card_id: "IP-041" status: "complete" source_document: "https://docs.google.com/document/d/1m_GbyZCNNebotF8KzIuEx3cwWakedG9SV9kgw-W1P7c/edit?usp=drivesdk"
What is DNS caching, and why can an old answer remain visible?¶
A device doesn't necessarily perform a complete DNS lookup every time it uses a domain name.
DNS answers can be cached.
A cache is a temporary stored copy of an answer that has already been obtained.
Caching makes DNS faster and reduces the number of queries sent across the network.
Copies of an answer may be held in several places.
A browser or application may have its own cache. The operating system may store the answer, as may a home router, workplace network or recursive DNS resolver.
When another lookup is needed, one of those systems may return its cached copy rather than contacting the authoritative DNS server again.
DNS records normally include a value called the Time to Live, usually shortened to TTL.
The TTL is expressed in seconds. It tells caching systems how long the answer may normally be retained before it should be treated as expired and looked up again.
For example, a TTL of 3,600 seconds allows the answer to be cached for one hour.
Suppose a domain name initially points to one IP address.
The domain operator then changes the DNS record so that the name points somewhere else.
The authoritative server may begin publishing the new address immediately. But resolvers and devices that cached the earlier answer may continue returning and using it until their cached copy expires.
This is why two users can perform lookups at roughly the same time and receive different answers.
One resolver may still have the old address cached, while another has already obtained the new one.
Caching also affects the records that may exist.
A device might connect to a domain without making a new DNS query because it already has the answer. The absence of a DNS query at the time of the connection doesn't therefore prove that the domain wasn't accessed.
The reverse is also true.
A DNS query may be cached and followed by several connections—or by no connection at all. The time of the lookup isn't automatically the time of the activity.
A DNS cache found on a device may help show that the device previously obtained information about a domain. But cached entries can expire, be overwritten or be created automatically by applications and background services.
A current DNS lookup also can't reliably recreate what every device would have received during an earlier event.
DNS caching means that an old answer can remain in use after the official record has changed. It improves efficiency, but it also separates the time an answer was obtained from the time it was later used.