It works for you. The rest of the world still has the old answer.
A resolver cache, two nameservers that disagree, or a zone the panel edits and nobody queries. We ask a resolver that is not your laptop.
Who is authoritative, then what they say
The registrar still points at the old host. Edits in Cloudflare do nothing until delegation matches. We do not keep changing the unused zone.
ns1 and ns2 out of sync after a panel move. One returns the new IP, one the old. Mail and the site flap. Both have to match before DNS is “done”.
TTL was a day, and the cut was this morning. Your resolver has the new record. A customer does not. That is waiting, not a broken server.
NXDOMAIN is not a 502
If the name does not resolve, NGINX is the wrong page. If it resolves to the right IP and the site errors, DNS is finished. Glue and a new nameserver pair are the configuration page.
€55 an hour. A propagation wait is not billed.
Minimum 1 hour. We need the zone that is actually authoritative. No registrar password in the first message.
Some people see the site, some see the old host?
Tell us the domain and when the record changed. No registrar password in the first message.