The Old Number Lingers

An A record has been published with a TTL of 86400 for years. Two hours before a planned IP migration you lower the TTL to 60, then cut over. For most of the following day a slice of users still lands on the old address. Why?

TTL applies only to negative answers; positive A record answers are cached for the interval in the zone's SOA minimum field, which was still set to one day

Resolvers that cached the record before the change keep it for up to the original 86400 seconds, so the short TTL governs only later lookups

TTL values are advisory, so recursive resolvers substitute their own fixed caching interval and the published number has no bearing on how long an answer is held

A TTL change does not reach resolvers until the SOA serial is incremented and every secondary nameserver completes a zone transfer, which is what actually took the extra day