What is DNS caching, and why can an old answer remain visible?¶
A DNS cache is a temporary stored copy of an earlier answer. It makes DNS lookups quicker and reduces repeated queries.
The short version¶
A cached answer can remain usable until its time to live expires. This means a device can connect using an earlier DNS answer even after the authoritative record has changed, and it may do so without making a new DNS query.
Where answers may be cached¶
A copy may sit in:
- a browser or application;
- the operating system;
- a home router;
- a workplace network; or
- a DNS resolver.
Any of these may return its stored answer without contacting the authoritative DNS server again.
Time to live¶
DNS records normally have a time to live (TTL), measured in seconds. The TTL tells a caching system how long it may keep the answer before looking it up again.
If a domain changes address, the authoritative server may publish the new address while some devices and resolvers continue using the old cached answer until it expires.
That is why two lookups made around the same time can return different results.
Follow one answer through a cache¶
At 09:00, Dave's laptop asks for files.example. Its resolver returns 198.51.100.24 with a TTL of 300 seconds. At 09:03, the domain operator changes the authoritative answer to 203.0.113.18.
| Time | What the system holds or does | Evidential meaning |
|---|---|---|
| 09:00 | Resolver returns 198.51.100.24, TTL 300 | This was the answer supplied at that observation point |
| 09:03 | Authoritative record changes to 203.0.113.18 | New lookups that reach the authority may receive the new route |
| 09:04 | Laptop uses cached 198.51.100.24 | No fresh DNS query is required; a connection record may still show the old address |
| After expiry | A fresh lookup returns 203.0.113.18 | The later answer must not be substituted for the route available during the earlier event |
The TTL controls how long a cache may reuse the answer; it does not prove that the answer was used throughout that period. A remaining TTL in a cache can also show only how long that stored copy has left, not necessarily when the authoritative record first existed.
What caching means for the evidence¶
Caching separates the time an answer was obtained from the time it was used.
- A device may connect without producing a new DNS query because it already has the answer.
- One DNS query may be followed by several connections.
- A query may be made without any later connection.
- A current lookup may not reproduce the answer available during an earlier event.
A cache found on a device can help show that the device obtained information about a domain. Record the entry, its source and any timing information before the cache changes or expires.
When reconstructing an event, compare the cached or logged answer with the connection, browser, application and platform records. They show different parts of the activity.
Operational takeaway
Preserve the cached name, answer, remaining TTL, collection time and source system. Use connection and application records to test whether the cached route was actually used.
