DNS Propagation Checker

How to use the DNS Propagation Checker tool

1. Enter the domain or subdomain, choose the record type (A by default) and click Check DNS.
2. The tool sends the same query to twelve public resolvers at once over DNS-over-HTTPS and lists each answer with its TTL and response time.
3. Look at the consensus box first. It shows the most common answer and the percentage of resolvers that returned it. A reading of 100% means the change has propagated everywhere we can see.
4. Rows that differ from the consensus are highlighted. Right after a change they hold the old value and will update when their cached TTL expires. For CDN or GeoDNS hosts, a different IP per region is normal.
5. Use the record type that matches what you changed: CNAME for a subdomain pointed at a host, MX and TXT for email, NS after moving nameservers, CAA when certificate issuance fails.

How to query a DNS record from several resolvers in code

# Ask three resolvers for the same record and compare
for ns in 1.1.1.1 8.8.8.8 9.9.9.9; do
  echo "== $ns"; dig +short @$ns example.com A
done

# Add +ttlid or drop +short to see the remaining TTL on each cached answer
dig @8.8.8.8 example.com A | grep -A1 "ANSWER SECTION"

// Any resolver that supports the JSON flavor of DoH
const resolvers = {
    cloudflare: "https://cloudflare-dns.com/dns-query",
    google: "https://dns.google/resolve",
};

for (const [name, base] of Object.entries(resolvers)) {
    const res = await fetch(base + "?name=example.com&type=A", {
        headers: { accept: "application/dns-json" },
    });
    const data = await res.json();
    console.log(name, data.Answer?.map((a) => a.data + " (ttl " + a.TTL + ")"));
}

import dns.resolver  # pip install dnspython

for server in ["1.1.1.1", "8.8.8.8", "9.9.9.9"]:
    r = dns.resolver.Resolver(configure=False)
    r.nameservers = [server]
    try:
        answer = r.resolve("example.com", "A")
        print(server, [str(x) for x in answer], "ttl", answer.rrset.ttl)
    except dns.resolver.NXDOMAIN:
        print(server, "NXDOMAIN")

Common errors and how to fix them

Some resolvers still show the old IP hours after the change

Their cached copy has not expired. The wait equals the old TTL, which was often 3600 or 86400 seconds. Nothing you do at the DNS host speeds this up; next time lower the TTL to 300 a day before the change.

NXDOMAIN on a record I just created

Either the record was saved under the wrong name (example.com vs www.example.com) or a resolver cached a negative answer from before it existed. Check the exact name at your DNS host and wait for the SOA minimum TTL.

Every resolver returns a different IP

The host uses GeoDNS or a CDN such as Cloudflare, Akamai or AWS CloudFront and answers with the nearest edge. That is correct behavior. Check that each IP belongs to the same provider with the WHOIS lookup.

SERVFAIL from several resolvers

The authoritative nameservers are not answering or the zone is broken, often a DNSSEC signature that expired or a nameserver record that points to a host that no longer serves the zone. Check the NS record and your DNS host's status page.

A CNAME record does not show for the root domain

A CNAME is not allowed at the zone apex because it would conflict with the SOA and NS records. Use an A or AAAA record, or a provider feature such as ALIAS or CNAME flattening.