A few things I keep forgetting about DNS
DNS is simple enough to configure in five minutes and strange enough to waste an afternoon. These are the ones that keep coming back.
TTL is a hint, not a contract
Resolvers cache for the TTL, but they are free to ignore it — some do, especially under load or when a record looks suspicious. Setting TTL to 60 does not mean the world sees your change in a minute. Plan migrations around the old TTL, not the new one.
Negative answers get cached too
A query for a name that does not exist is cached for as long as the negative TTL, often derived from the zone's SOA minimum. If you create a record while the "does not exist" answer is still fresh in a resolver, some clients will keep failing for minutes after the record is live. This is the usual explanation for "it works on my machine but not on my phone".
CNAME at the apex
The zone apex cannot legally hold a CNAME, because it must also hold SOA and NS records. Providers that appear to allow it are synthesising records behind the scenes (ALIAS, ANAME, or equivalent). That works, but the behaviour differs between providers and does not survive a zone transfer cleanly.
Propagation is the wrong word
Records do not propagate. There is no broadcast. There are cached copies of previous answers expiring at different times on different resolvers. When you ask "how long until it propagates", the honest answer is "until every cache that matters has expired".
Test from the authoritative server
dig @ns1.example.net www.example.com A +norecurseIf the authoritative answer is correct, the zone is correct. Anything else is a caching question, and caching questions resolve themselves if you stop poking them.