DNS propagation check

Asks several public resolvers about the same domain at once and puts the answers side by side. After a DNS change, this shows how far the change has spread and where the old answer is still being given.

Active tool

DNS propagation check

Ready

Need another tool?

Pick one of the 25 below

What the DNS propagation check measures

A DNS propagation check puts the same question to several public resolvers at once and lays the answers side by side. Six are asked directly from the IPVIEW server: Cloudflare 1.1.1.1, Google 8.8.8.8, Quad9 9.9.9.9, OpenDNS 208.67.222.222, and two inside Iran, TCI at 217.218.127.127 and IPM at 194.225.152.10. Each is asked for the A record with a 3.5-second timeout, and its response time is recorded.

Propagation is not a wave moving through the internet; it is each resolver's cache expiring on its own schedule. A resolver never asked about the name answers with the new record at once; one that cached the old record a minute before your change keeps it for the full TTL. The table is the state of six caches at one moment: a sample of the world, not the whole of it.

How to read the result

The banner states the comparison: every resolver gives the same answer, the answers differ, or fewer than two answered and no comparison was possible. Only real answers are compared; a resolver that timed out or returned SERVFAIL has no opinion and is shown with its error or response code rather than counted as disagreeing.

Differing answers are not always a problem. A site behind a CDN answers with different addresses from different places by design, and the Iranian resolvers will often show a different set from the four abroad for that reason. The question is whether the old address is still among the answers anywhere. An address inside 10.0.0.0/8 for a public site is an injected answer, not a cached one; the Reachability check names that case. An error from an Iranian resolver while the others answer usually means the path to that resolver, not the domain.

When it is useful

You have moved a site to a new server and want to know whether the change has reached visitors in Iran as well as abroad. When all six agree on the new address the move is done as far as DNS is concerned; if some still show the old one, the TTL set in the zone says how long at most they can keep it; the number in the A record lookup is only the time left on the copy 1.1.1.1 holds.

When a site works for you and not for a colleague, differing answers here are the explanation. If every resolver agrees and the site still fails for some people, DNS is not the layer at fault, and Ping and the Reachability check are the next questions.

Common questions

How long does DNS propagation take?

Up to the TTL of the record you replaced, counted from when each resolver last cached it: typically minutes to a day. Lower the TTL a day before a planned change and the window shrinks with it.

Why do the resolvers give different answers?

Either the change has not reached all of them, or the site sits behind a CDN that answers differently by region. Look for the old address: if it is nowhere in the table, the difference is the CDN's.

Does the check include resolvers inside Iran?

Yes, two of the six: TCI at 217.218.127.127 and IPM at 194.225.152.10. The result shows what visitors on those networks are told alongside Cloudflare, Google, Quad9 and OpenDNS.

Can I check an MX or TXT record's propagation?

This tool asks for the A record only. For other types use the single-record lookups, which ask Cloudflare, and compare with what your own resolver returns.

Limits. The DNS, WHOIS and SSL tools allow up to 20 requests a minute per IP address. Ping, traceroute and MTR send real packets to their target, so they allow 6 a minute.

The port check runs only against your own IP address. That is deliberate: the question people actually have, "is this port reachable from outside?", is answered by it, while this server cannot be used to scan anyone else's network.

Private and reserved addresses. These are refused by the tools that really connect to their target: the SSL check, ping, traceroute, MTR and the port check. The DNS tools have no such limit, because they only ask a nameserver a question and never connect to the address itself.