Contents
4 sections · 6 min read
Diagram showing DNS cache storing domain to IP mappings with TTL countdown
Domain Management

DNS Cache Explained: What It Is, How It Works, and When to Clear It

A
Domain 360 Team
·July 10, 2026·6 min read

DNS cache is one of those invisible mechanisms that works so well most people never think about it — until something changes and they are left wondering why a fixed problem is still broken for some users but not others. Understanding the layers is the key to diagnosing the real issue.

Quick answer: DNS cache is why some visitors see a broken site for hours after it should be fixed. Understanding how it works — and where caches live — makes you much faster at diagnosing the real problem.

How Do DNS Lookups Work Without a Cache?

When you type a domain name, your device needs its IP address. Without any cache anywhere, the process flows like this: your device asks your configured DNS resolver (usually from your ISP or a service like Cloudflare), the resolver checks the DNS hierarchy starting from root servers, finds the authoritative answer from the domain nameservers, and returns it. This takes milliseconds, but it is not free — it involves multiple network round trips.

With billions of users visiting the same popular domains constantly, doing this full lookup every time would put enormous load on the DNS infrastructure. Cache solves this.

TTL: Who Controls How Long Records Are Cached?

Every DNS record has a TTL value set by whoever manages the domain. The TTL tells every resolver and device in the chain: cache this record for this many seconds before checking again.

A record with TTL 3600 gets cached for one hour. After an hour, the resolver discards the cached value and fetches a fresh copy. A record with TTL 300 only lives in cache for five minutes — useful for records that might change, like mail server configurations.

This is important: when you change a DNS record, the old value continues to be served by caches worldwide until those caches expire. The lower the TTL, the faster changes propagate. Many experienced domain owners lower TTL to 300 before making a planned DNS change, then restore it afterward.

Where Does DNS Cache Live? The Four Layers

This is where most DNS troubleshooting goes wrong — assuming there is one cache, when there are actually four at minimum.

1. Operating System Cache

Your computer maintains its own local DNS cache — the one you clear with ipconfig /flushdns on Windows or the Terminal commands on Mac. This is the one most people mean when they talk about clearing DNS cache. It stores recent lookups for every application on the machine.

2. Browser Cache

Chrome, Firefox, Edge, and Safari all maintain separate DNS caches from the operating system. A website change might require clearing both the OS cache and the browser cache to take full effect. Chrome exposes its DNS cache at chrome://net-internals/#dns.

3. Router Cache

Your home or office router often caches DNS results for devices on the network. If you flush your computer cache but your router still serves the old record, your computer gets the old answer via the router. Restarting the router or logging in to clear its DNS cache resolves this.

4. Resolver Cache

The DNS resolver you use — whether that is your ISP, Cloudflare, or Google — also caches records for their TTL duration. When you query 1.1.1.1 for a domain, Cloudflare checks its own cache first. If it has a fresh copy, it returns that rather than querying further upstream.

This resolver cache is one you cannot flush yourself (unless you control the resolver). You are at the mercy of the TTL set by the domain owner.

What Are the Practical Implications?

When a domain owner makes a DNS change, propagation is not instantaneous because of all these cache layers. Your device might get a fresh answer within minutes, while another user's device holds the old cached record for hours.

If you are troubleshooting a site that should be working but is not: flush your local OS cache first, then clear the browser DNS cache, then check whether the router needs restarting. If the problem persists after all that, the issue is either at the resolver level (waiting for propagation) or the DNS records are genuinely wrong.

Checking the current live DNS records from a specific resolver is easy with the commands in our nslookup and dig guide. Running dig @1.1.1.1 yourdomain.com and dig @8.8.8.8 yourdomain.com separately shows whether different resolvers are returning different values — a clear sign of propagation in progress rather than a caching problem on your end.

One failure mode worth noting: cache cannot save you from an expired domain. When a domain lapses, its DNS records are withdrawn from the nameservers. Caches eventually expire and the NXDOMAIN result propagates. If a site went down suddenly and the problem is not resolving after all these steps, check the domain expiry date via WHOIS — an expired registration is a distinct problem that requires renewal, not cache clearing.

Quick Answers

What is DNS cache?
DNS cache is a local store of recent DNS lookup results — the translations from domain names to IP addresses. Your operating system, browser, and the DNS resolvers on the internet all maintain their own caches to avoid repeating the same lookups. Each cached entry has an expiry time set by the domain owner, called the TTL (Time to Live).
Where is DNS cache stored?
DNS cache exists at multiple layers: your operating system maintains one, your browser has its own separate one, your router typically caches results, and the DNS resolvers you use (from your ISP or a service like Cloudflare) cache at their level too. Changes may need to clear multiple layers to take full effect.
What is TTL in DNS?
TTL (Time to Live) is the number of seconds a DNS record should be cached before it must be refreshed. A TTL of 3600 means resolvers should cache the record for one hour. Domain owners set TTL values — lower values mean faster propagation of changes but more DNS queries; higher values reduce DNS query load.
How long does DNS cache last?
It depends on the TTL set by the domain owner, typically ranging from 300 seconds (5 minutes) to 86400 seconds (24 hours). Common values are 3600 (1 hour) for most records and lower values like 300 for records that change frequently. Operating systems and browsers may also impose their own minimum or maximum cache times.
Can DNS cache be poisoned?
Yes. DNS cache poisoning (also called DNS spoofing) is an attack where false records are injected into a resolver cache, redirecting users to malicious servers while the domain name looks correct. DNSSEC was designed to prevent this by adding cryptographic validation to DNS responses. Our guide on DNSSEC covers how to check and enable it.

Never lose a domain again

Track every domain you own in one dashboard. Free for up to 15 domains.