Tool 2.6

DNS propagation checker: 10 public resolvers at once

Ask 10 public resolvers (Google, Cloudflare, Quad9, OpenDNS…) for a name's A, AAAA, CNAME, MX, NS or TXT records and see if your DNS change reached them.

Online checkThe name and record type go to our server (api.ethorns.com), which asks 10 fixed public DNS resolvers and keeps only the result for 1 minute.

How to use it

Type the name you changed, for example example.com or www.example.com.
Pick the record type (A, AAAA, CNAME, MX, NS or TXT) and press Check. The name and type go to our server, which asks the ten resolvers.
Compare the answers. When all resolvers show your new value, the change has propagated.

When you'd check: new hosting, new email, new nameservers

You moved your website to a new hosting and changed the A record. You switched your email to a new provider and changed the MX records. You pointed the domain to new nameservers at your registrar. Some people already see the new site or get email at the new provider, others don't. This page asks ten public resolvers the same question at once, so you can see how far the change has gone.

Nothing actually travels across the internet. Each resolver keeps a cached copy of your old record until its TTL runs out, then asks your nameservers again and gets the new value. Since every resolver cached it at a different moment, each one updates at a different time.

7 of 10 resolvers already have the new IP

An hour ago you changed tienda-ejemplo.co from 198.51.100.20 to 203.0.113.45, and the old record had a TTL of 3600 seconds. Check type A: the result says “7 of 10 resolvers agree”. Seven rows show 203.0.113.45 with a ✓ in the Majority column. Three still show 198.51.100.20 with ✗, and their TTL column reads something like 1260: those resolvers will ask again in about 21 minutes.

The Majority column compares each answer with the most common one, not with the right one. Early on, the old value can be the majority and your new value gets the ✗. NXDOMAIN in a row means the name doesn't exist for that resolver. SERVFAIL means the lookup failed; right after a nameserver change it can point to DNSSEC, when the old DS record at the registrar no longer matches the new DNS provider.

Ten providers, not ten countries

All ten questions leave from our one server. Big public resolvers have locations all over the world, and we reach the one closest to us, so this compares ten providers, not ten countries. Your internet provider's own resolver isn't on the list and keeps its own cache.

Some resolvers filter on purpose: AdGuard blocks ad and tracking domains and CleanBrowsing blocks malicious ones, so a blocked answer there isn't a propagation problem. Results are kept for 1 minute, and only A, AAAA, CNAME, MX, NS and TXT records can be checked.

FAQ

How long does DNS propagation take?

It depends on the TTL of the old record: resolvers keep the old answer until it expires. Most changes show up within minutes to a few hours; nameserver changes can take up to 48 hours.

Why do resolvers give different IPs for big sites?

Large sites and CDNs answer with the server closest to each resolver, so different IPs are normal for them. Disagreement only matters for a record you just changed.

Which resolvers do you ask?

A fixed list of 10 well-known public DNS services: Cloudflare, Google, Quad9, OpenDNS, AdGuard, CleanBrowsing, Level3, Control D, Hurricane Electric and Yandex. We never query any other server.

Can I make a DNS change propagate faster?

Not after the fact: you can't empty other people's caches. Before a planned change, lower the record's TTL to 300 seconds and wait at least as long as the old TTL, so that when you switch, resolvers pick up the new value within minutes. Google Public DNS and Cloudflare also have public pages where you can ask them to drop a name from their cache.

Every resolver agrees, but my computer still shows the old site. Why?

Your own device, browser, router or internet provider may still have the old answer cached. Try mobile data, restart the router, or clear your computer's DNS cache (on Windows, `ipconfig /flushdns`). Browsers also keep pages in their own cache, so a private window helps.

Guides for this tool

G3How to set up DMARC in one day: SPF, DKIM and DMARCA one-day plan to set up SPF, DKIM and DMARC for your business domain, check them with free tools, and reach p=reject in the weeks after.

2.1What's my IP?See your public IP address, whether it's IPv4 or IPv6, your country, TLS and HTTP version, and what every website can learn from your connection.
2.2Email securityCheck a domain's SPF, DKIM, DMARC, MTA-STS, BIMI and DNSSEC, and get copy-ready DNS records for what's missing or wrong.
2.3SPF record builderBuild one SPF record for your domain from your mail services, servers and IP ranges.
2.4DNS lookupLook up any domain's DNS records (A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, SRV) or the reverse DNS of an IP, with TTLs and DNSSEC validation.
2.5Email header analyzerPaste an email's raw headers to see the servers it passed through, the SPF, DKIM and DMARC results your provider recorded, and signs of a forged sender.
2.7DMARC report readerOpen a DMARC aggregate report (.xml, .xml.gz or .zip) and see, for each sending IP, how many messages passed or failed SPF and DKIM.
2.8Is it down?Check whether a website answers, with its HTTP status, response time, redirects and HTTPS, measured once from our server in Colombia.
2.9DMARC record generatorBuild a DMARC TXT record: policy, test mode, report addresses and alignment.
2.10Link preview checkerSee how your link will look when shared on WhatsApp, X, LinkedIn or Facebook: check the title, description, og:image and Twitter card tags, with fixes.
2.11Subnet calculatorType an IP address with its prefix to get the network, mask, broadcast, usable host range and count, and split it into equal subnets.

╌╌ END ╌╌