DNS Propagation Checker
Changed a DNS record and wondering whether the world can see it yet? Ask several big public resolvers at once and compare their answers and remaining TTLs side by side. Enter the new value to see exactly which resolvers already have it.
Last updated:
How to use the DNS Propagation Checker
- Enter the domain or hostname you changed, for example www.example.com.
- Pick the record type you edited: A for an IPv4 address, MX for mail, TXT for SPF or verification, NS after moving DNS hosting.
- Optionally enter the expected value, such as your new server IP, to get a clear propagated / not yet verdict per resolver.
- Click Check propagation. Each card shows the resolver's answer, its remaining TTL and how fast it replied.
- Turn on auto re-check to watch the stragglers switch over; changed answers are marked with the time they changed.
How to read the results
| What you see | What it means | What to do |
|---|---|---|
| All resolvers agree | Every responding resolver returns the same record set (order ignored). | If it is the new value, the change is visible on these networks. ISP resolvers may still lag up to the old TTL. |
| Different answer | A resolver still has an older answer cached, or the domain uses geo-DNS / a CDN. | Check the TTL on that card: the stale answer expires within that time. |
| ✗ Not updated yet | The resolver answers, but not with your expected value. | Wait for the TTL, or double-check the value at your DNS host. |
| No records | The name exists but has no record of this type (NOERROR, empty answer). | If you just added it, the "no record" answer is cached for the SOA negative TTL. |
| NXDOMAIN | The resolver says the name does not exist at all. | Check spelling; for a brand-new domain or subdomain, wait for the negative cache to expire. |
| SERVFAIL | The resolver could not get a valid answer from your name servers. | Often broken DNSSEC (a DS record without matching DNSKEY) or unreachable name servers. |
Typical waiting times by change
| Change | Controlled by | Typical wait |
|---|---|---|
| Edit an existing A, AAAA, CNAME, MX or TXT record | TTL of the old record | 5 minutes to 1 hour on most DNS hosts (whatever TTL was set) |
| Add a record that did not exist before | SOA negative-cache TTL (RFC 2308), only if someone queried it before | Usually minutes; up to the SOA minimum value |
| Change name servers at the registrar | NS TTL at the TLD registry (often 1-2 days for .com/.net) | A few hours, up to 48 hours |
| Enable DNSSEC (add DS at the registrar) | DS record TTL at the registry | Usually up to a day; keep DNSKEY published before adding DS |
Tips for a smooth DNS change
- Lower the TTL first. A day before migrating, set the record's TTL to 300 seconds. Once the old, longer TTL has expired everywhere, your actual change will be visible within about 5 minutes.
- Keep the old server running. During propagation some visitors still reach the old IP. Leave it online (or redirecting) until all resolvers show the new value and the old TTL has passed.
- For mail changes, update MX and SPF together and keep the old mail server accepting messages for a day, so no email is lost while caches expire.
- The TTL counts down. A resolver shows the remaining cache time, so a TTL of 120 on a record configured with 3600 means that copy was fetched 58 minutes ago and will refresh in 2 minutes.
Frequently asked questions
What is DNS propagation?
When you change a DNS record, resolvers around the world that cached the old answer keep serving it until its TTL (time to live) expires. Propagation is the period in which some resolvers still return the old value while others already return the new one. Nothing is pushed out: each cache simply expires and fetches the current record.
How long does DNS propagation take?
At most the TTL of the old record, which is often 300 seconds to 1 hour and sometimes 24 hours or more. For a record that did not exist before, the negative cache time from the zone's SOA record applies instead. Changing name servers (NS) can take up to 24-48 hours because the TLD's NS records usually have long TTLs.
Which DNS servers does this tool check?
By default Cloudflare (1.1.1.1), Google Public DNS (8.8.8.8), Quad9 (9.9.9.9), AdGuard DNS (unfiltered) and NextDNS, queried directly from your browser over DNS-over-HTTPS (RFC 8484). You can add Mullvad, Control D, DNS.SB or any DoH URL of your own.
Why do resolvers show different answers even without a change?
Many sites use geo-DNS or a CDN, so the answer depends on where the resolver's server is. Round-robin records can also list IPs in a different order (this tool ignores order). Different values on a CDN-hosted domain are normal and not a propagation problem.
Why is a resolver shown as unreachable?
Your network, a VPN, a company firewall or a browser extension may block DNS-over-HTTPS, or the resolver may not allow requests from web pages. The other resolvers still give a valid comparison; you can deselect the failing one in the Resolvers list.
Can I speed up DNS propagation?
You cannot clear other people's caches, but you can plan ahead: lower the record's TTL to 300 seconds at least one old-TTL period before the change, make the change, then raise the TTL again once everything has switched. Cloudflare and Google also offer public cache-purge pages for their own resolvers.
Is checking a domain here private?
The query goes from your browser straight to the selected public resolvers; FreeToolCabin does not see or log it. Each resolver operator receives the domain name, as with any DNS lookup.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.