Cloudflare DNS propagation delay on gray-clouded subdomains: TTL flush fix

by

Cloudflare DNS propagation delay on gray-clouded (DNS-only) subdomains occurs when downstream recursive resolvers cache previous DNS records for the duration of the Time-To-Live (TTL) window previously served. When toggling a subdomain from proxied (orange-cloud) to unproxied (gray-cloud), Cloudflare sets the record TTL to an explicit value (defaulting to 300 seconds / Auto), but ISP resolvers and local client DNS caches often preserve the prior Cloudflare edge IP mapping until the old TTL expires. Additionally, public recursive resolvers (e.g., Google 8.8.8.8, Cloudflare 1.1.1.1, Quad9 9.9.9.9) maintain non-authoritative cached entries until an explicit cache purge is triggered.

Quick Fix

Flush your local OS DNS resolver cache and trigger an upstream DNS purge across public resolvers using curl:

# Flush local OS DNS cache (Linux/systemd-resolved)
sudo systemd-resolve --flush-caches

# Flush public Google DNS cache via API
curl -X POST "https://dns.google/resolve?name=sub.yourdomain.com&type=A" -H "Cache-Control: no-cache"

Step-by-Step Resolution

  1. Verify Authoritative Cloudflare DNS Record State: Query Cloudflare’s authoritative nameservers directly using dig to confirm that the gray-clouded subdomain is serving the origin IP rather than Cloudflare edge IPs:
dig @ns1.cloudflare.com sub.yourdomain.com A +norecurse

Ensure the returned ANSWER SECTION contains your origin server’s direct IP address with the updated TTL value.

  1. Purge Upstream Recursive Resolver Caches: Force major public recursive resolvers to flush their cached records for the specific subdomain:
  • Google Public DNS (8.8.8.8): Execute a flush request at [https://dns.google/cache](https://dns.google/cache) for sub.yourdomain.com (Record Type: A / AAAA).
  • Cloudflare Resolver (1.1.1.1): Submit a cache purge request via [https://1.1.1.1/purge-cache/](https://1.1.1.1/purge-cache/) for sub.yourdomain.com.
  • OpenDNS (208.67.222.222): Flush via OpenDNS CacheCheck at [https://www.opendns.com/cachecheck/](https://www.opendns.com/cachecheck/).
  1. Flush Local OS and Network Stack DNS Caches: Clear the local resolver cache on the client operating system to drop stale non-authoritative records:
See also  How to unban IP locked out by aaPanel Fail2ban via SSH terminal commands

On Linux (systemd-resolved):

sudo resolvectl flush-caches

On macOS:

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

On Windows (PowerShell / CMD):

ipconfig /flushdns
  1. Lower TTL Prior to Future Proxy Toggles: To prevent future propagation stalls when unproxying records, explicitly set the subdomain TTL to 2 minutes (120 seconds) in the Cloudflare Dashboard (DNS > Records) before toggling from orange-cloud to gray-cloud. Allow 5 minutes to elapse under the lower TTL setting before switching off the proxy.

Why This Fails for Some Users

  • ISP Recursive Resolver TTL Overrides: Certain Internet Service Providers (ISPs) implement aggressive DNS caching on recursive resolvers, ignoring low TTL values (e.g., 120s or 300s) set by Cloudflare and enforcing a mandatory minimum cache duration (e.g., 24 hours).
  • Browser-Level Internal DNS Caching: Modern browsers like Chrome and Firefox maintain independent internal DNS caches that ignore OS-level ipconfig /flushdns or resolvectl commands. Navigating to chrome://net-internals/#dns and clicking Clear host cache is required to purge browser-level entries.
  • Negative Caching (SOA Minimum TTL): If a query was made while the subdomain DNS record was temporarily missing or misconfigured during the grey-cloud transition, recursive resolvers cache the negative response (NXDOMAIN) based on the SOA record’s MINIMUM TTL value.
  • EDNS Client Subnet (ECS) Routing Mismatches: Global CDNs and DNS resolvers using EDNS Client Subnet route requests based on client IP subnets. A cache purge triggered without specifying an ECS location may leave regional cache nodes serving outdated IP records.

Leave a Comment