Work out the worst-case time a DNS change takes to reach every resolver, including the TTL you lowered beforehand.
Lowering a TTL does nothing until the previously published TTL has expired in every cache, so the change window is driven by the old value unless you lowered it far enough in advance. Once the short TTL is live, the worst case is that TTL plus refresh skew plus the time the edit takes to reach all authoritative servers. Cutovers fail when the change window is planned from the new TTL instead of the one still cached, leaving a fraction of users pointed at a decommissioned endpoint. Keeping the old target alive for the straggler tail is what makes a DNS migration safe.
DNS Propagation Time
worst case = effective TTL + resolver refresh skew + zone sync time, where the effective TTL is the lowered value only once the previously published TTL has expired everywhere.
worst case = effective TTL + resolver refresh skew + zone sync time, where the effective TTL is the lowered value only once the previously published TTL has expired everywhere. Lowering a TTL does nothing until the previously published TTL has expired in every cache, so the change window is driven by the old value unless you lowered it far enough in advance. Once the short TTL is live, the worst case is that TTL plus refresh skew plus the time the edit takes to reach all authoritative servers.
Cutovers fail when the change window is planned from the new TTL instead of the one still cached, leaving a fraction of users pointed at a decommissioned endpoint. Keeping the old target alive for the straggler tail is what makes a DNS migration safe.
This calculator takes 6 inputs: TTL currently published, TTL you lowered it to, Lead time since lowering the TTL, Zone sync to all authoritative servers, Resolver refresh skew, Resolvers that stretch short TTLs. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.