Loading Empire…

Skip to content

Learn Fix Tools

Search/

Appearance

Filter problems…

SPF Problems
DKIM Problems
DMARC Problems
DNS & Infrastructure Problems
Delivery Problems
Inbox Placement Problems
Provider Problems
Reputation Problems
Campaign Performance Problems
- High unsubscribe rate
- Low open rate
Warmup Problems

Home
Fix
DNS & Infrastructure Problems
Stale DNS cache after change

Stale DNS cache after change

Resolvers still serve prior answers after an authoritative change because TTL has not expired.

Reading time:: 5 min
Difficulty:: Intermediate
Estimated duration:: 5 min
Prerequisites:: None
Last updated:: 2026-07-15
Author:: empire

Problem summary

Resolvers still serve prior answers after an authoritative change because TTL has not expired.

Severity: Medium

Symptoms

Some networks see old records while others see new ones
Cutover appears incomplete for longer than expected

Possible causes

Misconfiguration
Incomplete rollout
DNS propagation delay

How to diagnose

Confirm the symptom in headers or reports
Inspect the relevant DNS records
Validate with a trusted checker

How to fix

Correct the DNS or signing configuration
Re-test and confirm alignment where required

How to verify

Re-check DNS
Send a test message
Confirm expected authentication results

Prevention

Document changes
Monitor reports after deployment

When to escalate

Production mail is failing authentication after a change window

TTLTime to live — how long resolvers may cache a DNS answer.
DNS propagationThe period while caches converge after authoritative DNS changes.

CNAME at zone apexA CNAME is placed at the zone apex where other record types are also required.
HELO / EHLO problemsThe SMTP HELO/EHLO hostname is missing, invalid, or inconsistent with reverse DNS.
Inconsistent authoritative answersAuthoritative name servers for the same zone return conflicting data.
Incorrect MX targetMX points to the wrong host name or unreachable mail server.
Missing glue recordsDelegation references in-bailiwick name servers without required glue.
MX record missingNo MX record is published for a domain that should receive mail.
NXDOMAIN for expected nameA name that should exist returns NXDOMAIN from authoritative servers.
Reverse DNS mismatchPTR (reverse DNS) for a sending IP is missing or does not match the forward hostname used in mail.
Wrong TTL for cutoverTTL values are too high for a planned cutover, prolonging mixed old/new answers.

digCLI DNS lookup utility for authoritative and recursive inspection of mail-related records.
nslookupInteractive DNS lookup utility commonly used for quick MX and TXT checks.
Google Admin Toolbox DigBrowser-based dig-style DNS lookup from Google’s Admin Toolbox.
Google Admin Toolbox CheckMXGoogle Admin Toolbox Check MX for inbound mail DNS sanity checks.

PreviousReverse DNS mismatch NextWrong TTL for cutover

Company

About
Contact
Services

Platform

Learn
Fix
Tools

Community

Empire is a living operator community — share practice, follow releases, and help shape the knowledge base.

Newsletter — coming soon

Legal

Privacy Policy
Terms of Use
Disclaimer
Editorial Policy
Cookie Policy

© 2026 Empire Email

Independent educational platform focused on email infrastructure, deliverability, and lifecycle marketing.