For some purpose it's also possible to explicitly make a DNS request against the authoritative server (which you get from the NS record) to have an actual instantly up-to-date answer.
That's how certbot and other Let's Encrypt clients work when using the DNS verification method rather than the HTTP one (using /.well-known/…), which you need to do for wildcard certificate for example. It allows verification of the _acme-challenge TXT record instantly after the update during the certificate renewal procedure.
That's how certbot and other Let's Encrypt clients work when using the DNS verification method rather than the HTTP one (using /.well-known/…), which you need to do for wildcard certificate for example. It allows verification of the _acme-challenge TXT record instantly after the update during the certificate renewal procedure.