TXT Record Propagation Checker

About DNS Propagation Checker

The same name asked of resolvers on four continents, and of the zone's own nameservers, so you can see who is still giving the old answer and how much longer they will.

The word propagation is misleading, and it is worth correcting rather than repeating. A DNS change does not spread outwards from anywhere: the instant you save it, every authoritative server for the zone has it. What takes time is the *old* answer expiring out of the caches that already fetched it — and how long that takes is exactly the TTL the old record carried. Not hours because DNS is slow; the number you set, counting down.

So this asks the authoritative servers as well, because comparing them is what separates the two things that look identical from outside: a cache that will expire on its own, and a change that was never made correctly.

There is a third thing that looks identical and is neither, and most propagation checkers get it wrong. A large site usually answers differently per region on purpose — GeoDNS, sending you to the nearest datacentre. Resolvers disagreeing is exactly what that looks like. This checks whether the disagreement falls along regional lines: if resolvers in the same place agree with each other and differ from those elsewhere, geography explains it and there is nothing to wait for. If two resolvers in the same place disagree, geography cannot explain it and something else is going on.

The resolver list is chosen for operator diversity rather than length. Two addresses from one provider share a cache and will nearly always agree, so thirty addresses belonging to six companies answers six questions while looking like thirty.

Where it helps

• Compares against the zone's own nameservers, so a stale cache is distinguishable from a change that never saved.
• Tells geographic routing apart from caching, which is the mistake that has people waiting for a change that already finished.
• Shows the TTL each resolver is holding, which is the actual remaining wait rather than a guess.
• Resolvers chosen for distinct operators and regions rather than for a big number.
• Walks up to the parent zone for the nameservers, so a subdomain still has an authority to compare against.

Limits

• Fourteen resolvers is not the internet. Your users' ISP resolver is not on the list and may hold a different answer for longer than any of these.
• Several public resolvers rate-limit or filter queries from datacentres, so a missing answer is usually about them rather than about your record.
• It cannot see inside a cache — only what a resolver returns now and how long it says it will keep it.
• A resolver that ignores TTLs, or an ISP that intercepts DNS entirely, will not behave the way this suggests. Both are commoner than they should be.
• The geographic test needs at least two resolvers in the same region to disagree before it can rule geography out, so an unusual split may be reported as geographic when it is not.

Frequently asked questions

How long does DNS actually take to update?

Exactly the TTL of the record you replaced, and no longer. If the old record had a TTL of 300 then every cache holding it forgets within five minutes; if it was 86400 then some caches will hold it for a day. This is why the trick is to lower the TTL a day *before* making a change — by the time you change it, nothing is holding a long-lived copy.

Some resolvers show a different address. Is my change broken?

Look at whether the split follows regional lines, which this reports. If resolvers in the same country agree with each other and differ from another country, that is geographic routing and there is nothing wrong. If two resolvers in the same place disagree, one of them is holding an old answer — and the TTL column says how much longer.

Why does one resolver give an answer that is nowhere in my zone?

Most likely an intercepting resolver. Some networks and some national infrastructures answer DNS queries themselves rather than forwarding them, and the answer has nothing to do with your record. It shows up here as a disagreement with no TTL pattern behind it, in one place, that never resolves.

Why check the nameservers as well as the resolvers?

Because "nobody can see my change" has two completely different causes that look the same: caches still holding the old answer, and a change that did not take effect at the authority. Asking the zone's own servers tells them apart in one query — if they do not have it either, no amount of waiting will help.

Related tools

• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• WHOIS — Registry records for a domain, an IP address or an AS number
• Reverse DNS Lookup — The PTR record for an address, and whether it confirms itself
• Email Authentication Checker — SPF, DKIM, DMARC and MX for a domain, read together
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• Port Checker — Test whether TCP ports accept connections

More Network & DNS tools

• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• Port Checker — Test whether TCP ports accept connections
• Nmap Port Scanner — Scan a host's common TCP ports, Nmap style, and see what each open service says it is
• Ping (TCP) — Measure connection latency with repeated TCP probes
• What Is My IP — Your public address, and what a browser reveals about you
• WHOIS — Registry records for a domain, an IP address or an AS number
• DNS Propagation Checker — The same name asked of resolvers worldwide, and of the zone's own servers
• Email Authentication Checker — SPF, DKIM, DMARC and MX for a domain, read together
• Email Header Analyzer — The delivery path, the authentication results, and what a forgery looks like
• DKIM Lookup — A domain's DKIM keys, for a selector or by trying the common ones, and whether each is worth anything
• DMARC Lookup — A domain's DMARC policy, and what it actually asks receivers to do
• Reverse DNS Lookup — The PTR record for an address, and whether it confirms itself
• IP Blacklist Checker — Whether an address is on the blocklists that actually stop mail
• Reverse IP Lookup — What an address says about itself: its name, its certificate, its network
• Traceroute — Every hop between this server and a host, with the time each one took
• Broadband Speed Test — Download, upload, latency and jitter, measured from this tab
• HTTP Headers — Grade a site's security headers from A+ to F, see every response header, and get the fix for your server
• Redirect Checker — Follow a URL's redirects hop by hop, and flag loops, downgrades and temporary redirects doing a permanent job
• IP Address Converter — Write an IPv4 or IPv6 address as an integer, hex, binary, expanded or mapped form, and see what kind it is
• MAC Address Lookup — Find the manufacturer behind a MAC address, and see what kind of address it is
• MAC to IP Converter — Build the IPv6 address a MAC forms with SLAAC, recover the MAC from one, or find a MAC's IP in an ARP table
• IP to MAC Lookup — Find the MAC address behind an IP: computed for multicast and EUI-64 addresses, or read from an ARP table
• DNSSEC Checker — Whether a domain's DNSSEC validates, and if not, whether it is the DS, a key, an algorithm or an expired signature