How-to Guides Networking

How to Check DNS Propagation

Check whether a changed DNS record is visible across major public resolvers, why some still show the old value, and how TTL decides how long you wait.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page
On this page

Steps

  1. Write down what you changed

    Note the exact name (www.example.com and example.com are different records), the type, the old and new value and the TTL the old record had.

  2. Run the propagation check

    Enter the name in the DNS Propagation Checker, choose the Type (A, AAAA, MX, TXT, NS or CNAME) and press Check Propagation. It asks Google, Cloudflare, Quad9 and OpenDNS directly, bypassing your own cache.

  3. Read each resolver's answer

    Each row shows the resolver, its IP and the records it returned, or NXDOMAIN, No answer or Timeout or unreachable. The badge says PROPAGATED when every resolver that answered returned the same records, INCONSISTENT when they differ.

  4. Wait out the old TTL

    A resolver still showing the old value cached it before your change. It will drop it no later than the old TTL after it cached it. Re-run the check after that time instead of changing the record again.

  5. If no resolver shows the new value, check the delegation

    Open the Domain WHOIS Lookup and read Name Servers, or query type NS in the DNS Record Lookup. If they point to a different DNS provider than the one you edited, your change is in a zone nobody asks.

  6. Clear your own cache

    Once the public resolvers agree, flush your computer: ipconfig /flushdns on Windows, sudo resolvectl flush-caches on Linux with systemd-resolved, sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder on macOS. Restart the browser too.

What you need

The name and record type you changed, the new value you expect, and ideally the TTL of the old record. You can read the TTL in your DNS provider's control panel before you edit. Changes to nameservers are made at the registrar instead and follow the same caching logic, with longer TTLs.

Reading the result

Say you moved www.example.com from 192.0.2.10 to 203.0.113.20, and the old A record had a TTL of 3600 seconds. Ten minutes after the change the checker shows:

Resolver Records
Google (8.8.8.8) 203.0.113.20
Cloudflare (1.1.1.1) 203.0.113.20
Quad9 (9.9.9.9) 192.0.2.10
OpenDNS (208.67.222.222) 203.0.113.20

The badge reads INCONSISTENT. Nothing is wrong: Quad9 answered a query for this name shortly before the change and may keep that answer for up to 3600 seconds. Within an hour of the change every resolver will have asked again and received the new address.

"Propagation" is really cache expiry. Your DNS provider updates its own servers within seconds; the rest of the internet catches up as cached copies time out. That gives a simple planning rule:

Old TTL Lower it to 300 s at least this long before the change Worst-case wait after the change
3600 s 1 hour 5 minutes
86400 s 24 hours 5 minutes

Raise the TTL again once the new value is confirmed everywhere.

Common pitfalls

  • Reading PROPAGATED as "my change is live". The badge only means the resolvers agree. If all four still return the old value, they agree on that. Check that the records are the new ones.
  • Overlooking error rows. A resolver that times out or answers NXDOMAIN is left out of the comparison, so the badge can say PROPAGATED while one row shows an error.
  • Expecting identical answers for big sites. CDNs and load-balanced services deliberately return different addresses depending on where the resolver is. INCONSISTENT is normal there.
  • Checking a name that has no address yet. The checker only accepts names that already resolve to an IP address, so a TXT-only name such as _dmarc.example.com is refused. Check the parent domain, or use the Email Deliverability Checker for SPF and DMARC.
  • Looking up a name before creating it. Resolvers also cache "this name does not exist" for a while. If you queried a new subdomain too early, wait before concluding the record is broken.

Going further

How resolvers, root servers, TLD servers and authoritative servers pass a query along, and where each cache sits, is covered in How DNS Works.

Try these tools

DNS Propagation Checker

Check a DNS record against Google, Cloudflare, Quad9, and OpenDNS public resolvers simultaneously to see if a change has fully propagated.

DNS Record Lookup

Look up A, AAAA, MX, TXT, NS, or CNAME DNS records for any domain in real time.

Domain WHOIS Lookup

Search the WHOIS database for domain registration details, registrar information, and expiration dates.

See also

  • Guide How DNS Works
    How a name becomes an IP address through resolvers, root, TLD and authoritative servers, the record types, TTL and caching.
  • Glossary DNS
    DNS (Domain Name System) is the internet's directory that translates domain names like example.com into IP addresses and holds other.
  • Glossary TTL
    TTL (time to live) is how long, in seconds, a DNS record or cached item may be reused before it must be fetched again.
  • Glossary Domain name
    A domain name is the human-readable address of a website or service, such as example.com, which DNS translates into an IP address.

Frequently Asked Questions

For a changed record, at most the TTL the old record had, because resolvers that cached it keep it until that time runs out. A record with a one-hour TTL is everywhere within about an hour. Nameserver changes at the registrar can take longer, often up to a day or two.

Not other people's resolvers. You can clear your own computer's cache, and some public resolvers offer a form to purge a name. Otherwise the only lever is to lower the TTL well before the change.

Back to the how-to guides
AdSense Placeholder
Slot: footer_leaderboard