DNS propagation checker
Changed a DNS record? This asks the domain’s own name servers what the record is now, asks public resolvers such as Cloudflare, Google and Quad9 what they give out, and shows which ones still hold an older copy and for how long.
By using these tools you accept the Terms and the Privacy page.
How the DNS propagation checker works
The checker answers one question after a DNS change: do the resolvers people use already give the new record? It asks the servers that hold the record and ten public resolvers the same question, compares the answers, and reads the remaining cache time from each resolver’s reply.
What happens during a check
First it finds the zone. It looks up NS records for the name you entered and for each of its parents (the eight shortest, never the bare top-level domain), and takes the longest name that has them. For _dmarc.mail.example.co.uk that is usually example.co.uk. Up to eight of the zone’s name servers are asked; when there are more, the page says how many were left out.
Each name server’s host name is resolved once and skipped if any of its addresses is private or reserved. The question goes to the checked address over TCP port 53, with a 3.5-second limit. Name servers that share an address are asked once. From each Cloudflare location, one address is asked about 40 times a minute at most, whoever is checking; past that it is listed as not asked. A name server counts only when its reply is authoritative (the AA flag); a referral is shown as such.
The public resolvers get the same question over TCP port 53, each with a 3-second limit. Cloudflare’s resolver is asked over DNS over HTTPS. No more than six requests (questions and the name servers’ address lookups) are in flight at once and the whole check stops at 9 seconds; a server whose turn hasn’t come by then is listed as not asked, and that check isn’t cached.
How answers are compared
Every reply is checked against the question that was sent (ID, name and type), and a reply that is cut off, malformed or too large is rejected. Record sets are put in one form before they are compared: sorted, host names in lowercase and without the final dot. The order a server lists records in never makes two answers.
When the name is an alias, the answer is its CNAME target alone, since the records behind it belong to another zone. “The name doesn’t exist” (NXDOMAIN) and “no record of this type” are two separate answers. The page shows up to 24 records and the first 1,000 characters of each, 8,000 characters in all; the comparison uses the full answer.
Reading the result
- Current: the resolver gives what the domain’s own name servers give now.
- Different: it gives something else, usually an earlier copy. “Cache time left” is how long it keeps that copy before it asks again.
- Most common and Same: shown when no name server could be asked and the resolvers are compared with each other.
- No answer: the resolver didn’t reply, with the reason in the answer column.
- TTL in the name server table is the lifetime the zone sets for the record: the longest a resolver should keep a copy.
Before you change a record
Lower the record’s TTL ahead of the change, at least as long before as the old TTL (a day covers most records), for example to 300 seconds, make the change, and raise it again once this page shows every resolver on the new answer. For mail records, check the result with the SPF, DKIM and DMARC checkers afterwards.
Updated · Maintained by Hertza L.L.C.
Questions
How long does DNS propagation take?
Nothing is pushed out. Every resolver keeps a copy of an answer for as long as the record’s TTL (time to live) says, then asks the name servers again. So a change is seen everywhere once the old copies have run out: at most the TTL the record had before the change. A record with a TTL of 300 is replaced within five minutes; one with 86400 can take a day. A change of name servers at the registrar takes longer, because the registry’s own delegation records are often kept for up to two days. A record that is new is held back by the zone’s negative-cache time instead, set in its SOA record and often up to an hour.
What does “current” mean on this page?
What the domain’s own name servers answer at this moment. They hold the record, so their answer is the reference. A public resolver that gives the same answer is marked Current; one that gives anything else is marked Different, with the time its copy has left. When the name servers disagree with each other, each of their answers counts as current.
Which resolvers are asked?
Ten public resolvers: Cloudflare (1.1.1.1), Google (8.8.8.8), Quad9 (9.9.9.9), Cisco OpenDNS, Hurricane Electric, Control D, AdGuard (its non-filtering service), DNS.SB, CIRA Canadian Shield and DNS4EU (its unfiltered service). Each one is asked directly by our servers. No third-party checking service is involved.
Does it check from many countries?
No. The resolvers are asked from the Cloudflare data center that runs your check, usually one near you, and the result names it. Each resolver is a worldwide network with many separate caches, so this is a sample of what they answer in that place at that moment. A cache elsewhere, or your own device, browser or router, can still hold an older copy until its TTL runs out.
Why does one resolver give a different answer?
Most often it still holds a copy from before the change, and the “cache time left” column says when it will ask again. Other causes: Quad9 and Cisco OpenDNS block domains they list as malicious, so their answer can be a block (the page notes this); a load-balanced or location-based record gives different addresses on purpose; and a name server that hasn’t received the change yet can feed resolvers the old record.
Why couldn’t the name servers be asked?
Our servers run on Cloudflare’s network and can’t open a direct connection to name servers that are on Cloudflare’s network too. Name servers that only send a referral, don’t answer in time, or whose name points to a private address are not used either. In each case the page says so and compares the public resolvers with each other instead.
Is the result cached?
For 20 seconds, so a reload doesn’t ask every server again. “Check again” asks them all afresh. A check that ran out of time, met an address at its limit or got no answer isn’t kept.