DNS Records & TTL
dig example.com prints one line: a name, a couple of numbers, and an address. Change that address at the source and half the internet keeps handing out the old one for hours, each server on its own clock.
- ▸A DNS answer isn't an address, it's a five-field row; one field sets how long the world trusts it.
- ▸Change a record and nothing is pushed anywhere; each resolver serves the stale answer until its own countdown ends.
- ▸Lowering the number the day you change a record does nothing for that change, only the next one.
dig example.com prints one line in its answer section, and it reads as five fields in a fixed order: example.com. 300 IN A 192.0.2.10.
The first is the name you asked about. The second, 300, is the TTL, a bare count of seconds standing on its own, not glued to the address that follows. The third, IN, is the class, and it is IN for essentially everything on the internet. The fourth, A, is the type. The fifth, 192.0.2.10, is the record data, the rdata, that the type points at.
Read left to right the row is name, seconds, class, type, data, and each column does one job. The number is not part of the address, and the type is not part of the data; they are separate columns you can change one at a time. Once you can point at all five, every line dig ever prints becomes legible.