NetSight
IP …

DNS Propagation

Check how a DNS record resolves from around twenty locations worldwide at the same time, see how long each resolver took, and add a port to test whether the service behind the record accepts connections from every location.

What propagation actually is

Nothing is pushed anywhere when you change a DNS record. Resolvers around the world hold the old answer until the time-to-live you set on it runs out, then ask again. "Propagation" is just those caches expiring at different moments.

This tool queries the same name from probes across Europe, the Americas, Asia, Africa and Australia at once and groups the answers. One group means everyone sees the same thing. Two or more means the locations disagree, which is what a change in progress looks like, and also what a domain that answers by region looks like.

Each location reports two numbers: how long its resolver took to answer, and how much longer it may serve that answer before it has to ask again. The second one is what decides how long a location can still show an old value, no matter what you change at your provider. A resolver that answers in under a millisecond did not ask anyone, it read the answer out of its own memory, and that is shown as "from cache" rather than as a time. Add a port to the name, as in example.com:25565, and every location additionally tries to open a connection on that port, so you see whether the service behind the record is reachable and not just whether the name resolves.

Reading the result

  • One group: consistent everywhere. The change is done, or there was nothing to change.
  • Two groups: either a change is still spreading, or the domain answers differently by region on purpose. Large sites and anycast setups do the latter permanently, so disagreement alone is not proof of a problem. Compare against what you expect the record to be.
  • A probe with no answer: that resolver got no record at all, which is different from getting an old one and often points at a deleted or misspelled name.

Why it can take so long

The wait is set by the TTL that was in place before you made the change, not the one you set afterwards. If the old record said 86400, resolvers that cached it are entitled to keep that answer for a full day, and lowering the TTL now changes nothing for them.

That is why the usual advice is to lower the TTL a day ahead of a planned move, make the change once the short TTL is everywhere, then raise it again.

When it's useful

  • Checking whether a nameserver or hosting move has finished before cutting over.
  • Explaining why a site loads for you but not for a colleague in another country.
  • Confirming a deleted record is really gone everywhere.
  • Verifying an MX change before mail starts flowing to the new server.

Questions

How long does propagation take?
As long as the previous TTL allowed. If the old record had a TTL of one hour, an hour. If it was a day, a day. There is no way to force other people's resolvers to drop a cached answer early.
I changed the record but every probe still shows the old value. Did it fail?
Not necessarily. Check the record at your own DNS provider first. If it is correct there, the probes are simply serving cached answers and you have to wait out the old TTL.
Why do some probes disagree with my computer?
Your computer, your router and your provider all cache separately, and a public resolver such as the one on your phone's mobile connection caches differently again. Disagreement between you and the probes is expected mid-change.
What do the two numbers on each location mean?
The left one is how long that resolver took to answer. Under a millisecond means it answered from its own memory and asked nobody, which is shown as "from cache". The right one is the remaining lifetime of the answer: how much longer that resolver may keep serving it before it has to ask again. During a change, the right number is the one that matters, because it is how long that location can still hand out the old value.
What does the port check actually test?
Whether a TCP connection to that port can be established from each location. A service that accepts the connection but speaks no HTTP, such as a game or mail server, still counts as reachable. Refused means something answered and rejected the connection, usually a closed port. No answer means the packets went nowhere, which is what a firewall that drops traffic looks like.
Which record type is queried?
The A record for the name you enter. For MX, TXT or others, use the DNS Lookup tool, which returns every type at once from authoritative servers.
Does this query authoritative servers?
No, and that is the point. It deliberately asks ordinary resolvers, because those are what your visitors actually use. For the authoritative answer, use DNS Lookup.
DNS Lookup
Query A, AAAA, MX, TXT, NS, SOA, CNAME, CAA and SRV records from authoritative resolvers.
Mail Check
Domain mail posture: MX, SPF, DKIM selector probe, DMARC.
DKIM Check
Find a domain's DKIM selectors automatically, or check one you already know.
Email Header Analyzer
Paste raw headers: route with delays, SPF, DKIM, DMARC, likely origin and a plain verdict.