03 / OPERATIONS

Reading a DNS lifetime.

Changing an authoritative record does not replace every cached answer at once. A resolver may continue serving an earlier answer while its lifetime remains valid. Applications can also keep their own caches or existing connections.

Ask which answer.

Distinguish the authoritative record, the answer from a recursive resolver and the address an application actually connected to. These observations can legitimately disagree during a transition.

Prepare before the change.

Reducing a record’s lifetime is useful only after previously cached answers have had time to expire. A lower lifetime published at the same instant as an address change does not shorten the lifetime attached to an answer already held elsewhere.

Verify the service too.

A correct address does not prove that the new service has the right certificate, hostname handling or application configuration. Test the address and the hostname together, retaining normal certificate validation.

A migration is complete when the intended clients reach the intended service — not merely when the dashboard displays a new value.