Skip to content
Register

The DNS propagation I didn't plan for

Reviews by jane_ffm 23 replies 2.5K views
jane_ffm

Member OP

13 #1

Planned migration from Time4VPS to Contabo. Reduced TTL to 300s 48 hours before. Or so I thought.

The registrar lock. Not the domain lock — the registrar-level change lock I didn't know my old registrar had added in 2023. "Security feature." No notification. Transfer went through. DNS changes published. Global propagation: 4 hours.

But the old registrar's nameservers kept serving stale records for 44 additional hours. Authoritative for our zone somehow? Glue records? Still unclear. Their support: "cache will clear."

It didn't "clear." It aged out. 48 hours total. Revenue impact: measurable. Reputation impact: worse.

Lessons:

  • Verify TTL reduction at every level, not just zone apex
  • Check for hidden registrar locks beyond standard transfer lock
  • Have monitoring on DNS resolution from multiple vantage points, not just propagation checkers
  • Document your registrar's "security features" annually — they add them silently

The 7-day story in replies below made me feel slightly better. Slightly.

— Jane @ Contabo

Single mode till I die 💀
lee_mcr

Member

4 #2

Two spaces after periods. Old habit. Hard to break.

Your registrar lock discovery mirrors a failure mode I documented in 2019. The "security feature" proliferation is a silent killer. I now maintain a quarterly audit calendar specifically for registrar-level surprises.

Honey badger don't care... about downtime
RAJ

Member

#3

Guys this is why I always budget 72hr for any client migration... margins are thin already and one dns blowup eats the whole project profit... any leads on registrars that dont do this hidden lock stuff?

Also @jane_ffm your Contabo plans... do you guys have api access for dns ttl changes? Or manual only? Recieved conflicting info from your sales last month

your margin is my opportunity
ellagee91

Member

#4

The seven day one was me. Different registrar. KnownHost. They had a "premium dns protection" I never opted into. Found out during an emergency migration. Five days to disable. Two more for actual propagation. The lock re-enabled itself after thirty days. I only found out because it happened again. Now I check every migration. Three times. Even then I miss things. You never really know what they added until it breaks. Especially with the budget registrars. The ones that look cheap until they aren't. You get the idea...

svendeal

Member

Deal Sniper

#5

Which registrar was the old one, the one with the lock

world record: 4min Arch install
JokoNord

Member

#6

44 hours on stale records with TTL 300s? That's rough

traffic worse than my packet loss
jane_ffm

Member OP

#7
svendeal said:
Which registrar was the old one, the one with the lock

I'd rather not name them publicly while I'm still disputing the invoice. Small European registrar, not one of the big five. The kind that resells OpenSRS or Key-Systems and adds their own "value-add" layer on top.

RAJ said:
Do you guys have api access for dns ttl changes?

Contabo's DNS is manual through their panel. No API for TTL that I've found. We ended up scripting the changes via their web UI with Selenium, which is exactly as fragile as it sounds. For the next migration I'm moving DNS to Cloudflare first, then migrating hosting separately.

Single mode till I die 💀
frankfurt_ops

Member

#8
jane_ffm said:
For the next migration I'm moving DNS to Cloudflare first

This. DNS and hosting should never be coupled at the same registrar. I run our zones on Cloudflare with 120s TTL as default. Last provider switch took 18 minutes from "new server ready" to "100% traffic shifted." Frankfurt to Nuremberg, but the principle holds anywhere their network touches.

The real cost isn't the propagation time. It's the sleep you lose refreshing dig every 30 seconds for two days.

JokoNord

Member

7 #9
jane_ffm said:
I'd rather not name them publicly while I'm still disputing the invoice.

This is what confuses me. TTL 300s should mean 5 minutes. Even with some resolvers ignoring TTL, 44 hours means something else was wrong. The old registrar's nameservers were still authoritative somewhere?

I had similar with a .id domain once. The registry itself caches nameserver glue for 24 hours minimum. Nothing you can do from registrar side.

traffic worse than my packet loss
RAJ

Member

1 #10
jane_ffm said:
No API for TTL that I've found

Thanks for confirming. Their sales told me "API coming Q2" but that was 2023. Manual it is.

For registrars without hidden locks: I've had good luck with Porkbun and Namesilo. No surprise features, no "premium protection" auto-enrollment. YMMV.

your margin is my opportunity

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft