What is DNS cache? How DNS caching works and how to flush it

A DNS cache is a temporary store of recent DNS lookups: it remembers which IP address belongs to a domain name, so your device does not have to look it up again every time. Your browser, your operating system, your router and your internet provider's DNS server each keep one. Every cached answer expires after the TTL (time to live) set on the DNS record, which is also why an outdated answer can linger for a while after a domain's DNS has changed.

This guide explains how DNS caching works, where the caches live, the benefits and drawbacks, and how to view and flush the DNS cache on Windows, macOS, Linux, in your browser and on your phone.

What is a DNS cache?

The Domain Name System (DNS) translates names like ljpc-hosting.nl into the IP addresses computers use to connect. Each translation is a DNS lookup. Storing the answer for next time is called DNS caching, and the place it is stored is the DNS cache.

Every cached answer comes with a lifetime: the TTL, a number of seconds that the domain owner sets per record. With a TTL of 3600, a cache may reuse the answer for one hour. After that it discards the answer and fetches a fresh one on the next request. How the TTL affects DNS changes is covered in DNS propagation.

How does DNS caching work?

When you type a web address, the lookup passes a chain of caches. The first one that has the answer returns it:

1. Your browser checks whether it looked up the name recently.
2. Your operating system (Windows, macOS, Linux, iOS or Android) checks its own DNS cache. On Windows this cache also holds the entries from the hosts file.
3. Your router forwards the query and, on many models, caches answers itself.
4. The resolver, your ISP's DNS server or a public one such as Google's or Cloudflare's, checks its cache. It holds the answers it fetched earlier for all its users, so popular names are almost always already there.
5. If nobody has the answer, the resolver asks the root servers, then the servers for the extension (such as .com or .nl) and finally the domain's nameservers, which give the authoritative answer.
6. On the way back, each step stores the answer for as long as the TTL allows. The TTL counts down: an answer from a resolver's cache shows how many seconds it remains valid there.

A "this name does not exist" answer (NXDOMAIN) is cached too. This is called negative caching, and the domain's SOA record sets how long it may last.

Where is the DNS cache stored?

What is a caching DNS server?

A caching DNS server, also called a resolver or recursive DNS server, is the DNS server your device uses to look up names. It finds the answer for you and keeps it, so the next request from you or anyone else is answered straight away. By default this is your ISP's DNS server. If you want a different one, for privacy or malware filtering, see public DNS vs ISP DNS servers.

An authoritative nameserver is the opposite. It does not cache other people's answers; it is the source for the domains it manages. For domains hosted with LJPc, those are ns1, ns2 and ns3.ljpc.network.

Benefits of DNS caching

• Faster page loads. A cached answer is available immediately, without the trip past root servers and nameservers. This adds up, because a page that loads fonts, videos or analytics from several domains needs a lookup for each of them.
• Less load and less traffic. Resolvers and nameservers receive far fewer queries, because one answer serves many users.
• Resilience during short outages. If a nameserver is briefly unreachable, answers already in caches keep working until their TTL runs out.

Drawbacks and challenges of DNS caching

Stale answers after a change

When you move your website to another server or change your MX record, caches keep serving the old answer until the TTL expires. Some visitors see the new site while others still see the old one. On your own device you fix this by flushing the cache (see below). For everyone else, lower the TTL well before the change, as explained in DNS propagation.

Not every resolver follows the TTL exactly

A resolver may keep an answer for less time than the TTL says. Google Public DNS generally caches answers for six hours at most, even when the TTL is longer. Some resolvers, on the other hand, hold on to answers for longer than the TTL allows, so allow some margin when you make a change.

A new name that does not work yet

If someone looked up a subdomain before it existed, the "does not exist" answer is now in their cache. Once you create the subdomain, it stays unreachable for them until that negative cache entry expires. Flush your own cache when you want to test a new subdomain or record right away.

DNS cache poisoning

In DNS cache poisoning, also called DNS spoofing, an attacker tries to get a forged answer into a resolver's cache, so visitors end up on a fake website while the correct name shows in their address bar. In 2008, security researcher Dan Kaminsky showed this could be done far faster than anyone expected (CERT/CC VU#800113). Since then, resolvers send queries from random source ports, which makes a forged answer much harder to guess. According to CERT/CC that does not rule the attack out completely. DNSSEC does that job: a resolver checks a digital signature to confirm the answer really comes from the domain's nameservers. See what is DNSSEC.

How to view your DNS cache

• Windows: run ipconfig /displaydns in Command Prompt to list cached answers and hosts file entries. In PowerShell, Get-DnsClientCache shows the same list as a table.
• Linux with systemd-resolved (version 254 or later): sudo resolvectl show-cache.
• Firefox: go to about:networking#dns to see each cached name, its addresses and the seconds until it expires.
• Chrome and Edge: chrome://net-internals/#dns (in Edge edge://net-internals/#dns) no longer lists entries, but lets you look up a name and clear the cache.

How to flush the DNS cache

Flushing the DNS cache is safe. It only removes stored addresses, not passwords, bookmarks or files, and your device looks names up again afterwards. Flush it when you still see an old website after a DNS change, when a new subdomain works elsewhere but not for you, or when a site shows an error for you and not for others.

Windows 10 and 11

1. Click Start and type cmd.
2. Right-click Command Prompt and choose Run as administrator.
3. Type ipconfig /flushdns and press Enter. Windows confirms with "Successfully flushed the DNS Resolver Cache."

In PowerShell, Clear-DnsClientCache does the same.

macOS

1. Press Command and the space bar, type Terminal and press Return.
2. Type sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder and press Return.
3. Enter your Mac's password and press Return. Nothing appears while you type, and there is no confirmation: no error message means the cache has been flushed.

Linux

On distributions that use systemd-resolved, such as Ubuntu and Fedora, run sudo resolvectl flush-caches. If your system uses another DNS cache, such as dnsmasq or nscd, restart that service instead.

Chrome and Edge

Chrome and Microsoft Edge, which is built on the same Chromium base, keep their own DNS cache next to the one in your operating system.

1. Go to chrome://net-internals/#dns (in Edge: edge://net-internals/#dns).
2. Click Clear host cache.
3. Go to chrome://net-internals/#sockets (in Edge: edge://net-internals/#sockets) and click Flush socket pools. This closes connections still open to the old address. Pages loading at that moment may break, so reload them afterwards.

Firefox

1. Go to about:networking#dns.
2. Click Clear DNS Cache.

Safari

Safari has no button of its own for this. Flush the macOS cache as described above, then quit Safari completely with Command+Q.

iPhone, iPad and Android

Phones and tablets have no button or command to flush the DNS cache. Restart the device and it starts with an empty cache.

Router

If your router hands out DNS to your devices, it often caches answers too. Restart the router to clear that cache; your internet connection drops until it has started up again.

Flush Google Public DNS and Cloudflare 1.1.1.1

You cannot flush your ISP's DNS cache yourself; there you wait for the TTL to expire. Google and Cloudflare do let you refresh their public DNS caches per domain name, and you do not have to prove you own the domain:

• Google Public DNS (8.8.8.8): on dns.google/cache, enter the name under Domain Name, pick the RR Type, solve the reCAPTCHA and click Flush Cache. If the domain recently moved to new nameservers, flush the main domain first and subdomains such as www after that.
• Cloudflare (1.1.1.1): on one.one.one.one/purge-cache, enter the domain name, pick the record type and click Purge Cache.

This helps everyone who uses those resolvers. For everybody else, the TTL still decides when they get the new answer.

DNS caching and your domain at LJPc hosting

If your domain uses the LJPc nameservers (ns1, ns2 and ns3.ljpc.network), we run the source that every cache gets its answer from. Here is what you can count on:

• Changes reach our nameservers within a minute. You manage your records in Plesk if a hosting plan belongs to your domain, and in the customer portal if you only have DNS management with us. In Plesk, click Update above the record list after saving. Step by step: manage DNS records.
• The TTL is usually one hour (3600 seconds), and one day for some domains. You can change the TTL per record. Lower it well before a migration and the switch shows up everywhere quickly. Run dig @ns1.ljpc.network yourdomain.com to see the current TTL of your record.
• A "does not exist" answer is cached for one hour at most. A new subdomain or record is visible to everyone within the hour, including anyone who looked it up before it existed.
• We handle DNSSEC automatically when your domain is registered with us and uses our nameservers, which protects visitors with a validating resolver against forged answers.

Your DNS cache is separate from your website's cache, which stores pages and images so they load faster. To set that up, see speed up your website with caching and compression.

Still seeing an old or wrong answer after flushing your cache and waiting for the TTL? Then something else is going on. Work through troubleshoot DNS problems, or create a support ticket and we will sort it out with you.