DNS Propagation Check

DNS Propagation Check

Enter a domain, pick a record type and click Check Propagation. The tool asks nine public DNS resolvers what they currently have for that record:

• Google Public DNS
• Cloudflare, plus its Security and Family resolvers
• Cisco Umbrella (formerly OpenDNS)
• NextDNS
• DNS.SB
• Alibaba DNS
• DNSPod

You can check A, AAAA, MX, CNAME, TXT, NS and SOA records.

What "propagation" actually means

Nothing is really pushed around the internet when you change a DNS record. The change is live on your DNS provider's servers almost immediately.

What takes time is caching. Every resolver that looked up your domain recently keeps the old answer until its TTL (time to live) runs out. A resolver with an expired cache, or one that never looked you up, gets the new answer straight away. That's why, for a while after a change, some resolvers show the new value and others still show the old one.

Reading the results: google.com as an example

Here's what an A record check on google.com returned:

Almost every resolver got a different answer, and every one of them is correct, because they're all Google servers. Large sites and CDNs hand out different IPs depending on where a query comes from, so traffic goes to a nearby server. For a domain like this, different answers don't mean the change hasn't spread. If you see unfamiliar IPs, check who owns them with IP Information or IP to Hostname.

A typical small site on one server is simpler. Once the change has spread, every resolver should show the same single IP.

What different results mean

Every resolver shows the new value. You're done as far as the big public resolvers go. Visitors whose ISP resolver still has the old answer cached will catch up when the old TTL expires.

Some show the new value, some the old one. This is normal in the middle of a change. The resolvers showing the old value cached it before you made the edit. Wait for the old TTL to pass.

Every resolver still shows the old value, long after the old TTL. The change probably never went live. The most common reason is editing the record in the wrong place: if your domain's nameservers point to Cloudflare, changes at your registrar do nothing. The NS row in DNS Lookup shows which provider is in charge.

No resolver finds the record. Check the name for typos. Also check whether your DNS panel adds your domain to the name automatically. In many panels, typing www.example.com in the name field creates www.example.com.example.com. Type just www instead.

One resolver says "Service unavailable." That resolver didn't answer our check in time. It says nothing about your domain, so run the check again.

Only Cloudflare Security, Cloudflare Family or Cisco Umbrella fail. These resolvers block domains they've classified as malware, phishing or adult content, usually by answering 0.0.0.0. If your site resolves everywhere except there, it has probably been flagged. This often happens to recently hacked sites and to domains with a bad history under a previous owner. Each provider has a form for requesting a review.

Tips by record type

A and AAAA. Use these when moving to a new server. Check both. A forgotten AAAA record still pointing at the old server sends IPv6 visitors to the wrong place.

CNAME. Check the full subdomain, such as www.example.com. A root domain can't normally have a CNAME, so a CNAME check on example.com usually comes back empty even when everything is fine.

MX. Use this when switching email providers. Until every resolver shows the new mail server, some incoming mail may still reach the old one, so keep the old mailbox running for a day or two.

TXT. Use this for SPF records and site verification codes. DMARC records live on their own name, so check _dmarc.example.com rather than the bare domain.

NS. Use this when changing DNS providers. Expect up to 48 hours, because the registry for your domain extension caches nameserver records longer than ordinary records. Before you switch, copy every record to the new provider. Then it doesn't matter which provider a resolver asks during the changeover.

SOA. After a nameserver switch, SOA answers that show your new provider's details mean that resolver has moved over.

How to make changes spread faster

1. Lower the TTL before you make the change. If your record has a 24-hour TTL, set it to 300 seconds at least a day before the move, so every cached copy expires within five minutes of the switch. Raise it again once things have settled.
2. Clear the big public caches. Google Public DNS and Cloudflare both have public pages where you can ask them to drop a cached record (Google's "Flush Cache" page and Cloudflare's "Purge Cache" page).
3. Clear your own computer's cache. On Windows, run ipconfig /flushdns. In Chrome, go to chrome://net-internals/#dns and clear the host cache.

There's no way to clear an ISP's resolver. For those you have to wait out the old TTL.

FAQ

How long does DNS propagation take?

For an ordinary record change, it takes as long as the old TTL, anywhere from five minutes to a day. Nameserver changes can take up to 48 hours. A few ISP resolvers keep answers longer than the TTL says, so occasionally someone sees the old site a little longer than expected.

Does this show what people in each country see?

Not exactly. The Location column shows where each resolver's company is based, not where your query was answered. Public resolvers run servers in many countries, and our check reaches whichever server is closest to us. Most people also use their ISP's resolver rather than a public one.

So treat the results as a check of the major public resolvers, not a view from every country.

What's the difference between this and DNS Lookup?

DNS Lookup shows all of a domain's records as one resolver sees them. Propagation Check shows one record type as nine resolvers see it, which is what you want right after making a change.