Asking different DNS resolvers: how to read a propagation checker without panic

Domains & DNS·· 12 views· 4 min read

The short answer: an online propagation checker asks the same name of a list of public resolvers around the world and draws the answers on a map. A mixed map is normal: each resolver has its own cache and its own clock. The map does not show your internet provider’s resolver, nor your customer’s, nor your computer. The source is what counts, and the number that tells you how long each cache has left is the TTL in the answer.

What the map shows, and what it means

What you see What it means
Some show the new value, some the old one Caches of different ages. Normal until the old TTL has passed; see what propagation really is.
All new on the map, but you still see the old one Your resolver or your computer is not on the map. See the caches ipconfig does not reach.
All old, long after the old TTL Most likely the source still has the old value: the change was not saved, or it was saved in a zone nobody reads any more.
Red crosses or “no answer” on some That resolver did not answer the checker. It does not mean the change failed. Isolated crosses can be ignored.
Several different addresses, all valid The domain has more than one address on purpose, or sits behind a CDN that answers by location, such as Cloudflare. That is not propagation.
“Does not exist” (NXDOMAIN) on some, after you created the record Negative caching: they asked before the record existed. See negative caching and the SOA.

Asking the same question from the command line

1 Ask the source. dig NS asuaempresa.ao +short gives the nameservers; then dig @dns1.interweb.ao A asuaempresa.ao +noall +answer if the zone is with us (otherwise use one of the names the first command returned). This is the right answer; everything else is a copy.
2 Ask public resolvers run by different companies: dig @1.1.1.1 A asuaempresa.ao +noall +answer
dig @8.8.8.8 A asuaempresa.ao +noall +answer
dig @9.9.9.9 A asuaempresa.ao +noall +answer
3 Ask your own network’s resolver, with no @: dig A asuaempresa.ao +noall +answer. That is the one your computer uses.
4 Read the second column. In a resolver’s answer, the TTL counts down: it is the number of seconds that resolver will keep that answer. If it shows the old value, it changes at the latest when that number reaches zero.
5 On Windows, without dig: nslookup asuaempresa.ao 1.1.1.1 asks a resolver of your choice, and in PowerShell Resolve-DnsName asuaempresa.ao -Server 1.1.1.1 shows the TTL as well.
6 Ask for the right type. If you changed the MX, ask for MX; if you changed a TXT, TXT. More on reading the answer in checking DNS from the command line.
An all-green map does not mean your visitors already see the new value. Their internet providers’ resolvers are not on the map. And asking the same public resolver twice can give different answers: behind an address like 8.8.8.8 there are many servers, each with its own cache.
Before looking at maps, check the source. If the source is right, the rest is time and the TTL tells you how much. If the source is wrong, no map will ever turn green.

The map still looks odd and you cannot tell cache from mistake? Tell us the domain, the record type and the value you expect to see.

Open a support ticket

SEE ALSO

Checking DNS from the command line: dig and nslookup, and how to read the answer

How to check a domain DNS

What DNS propagation really is: caches that expire, not a change that travels

A new record that still does not exist for some people: negative caching and the SOA

I changed the DNS and nothing shows yet: TTL, cache, and the four places to check

DNS records explained: A, CNAME, MX, TXT and TTL

RECOMMENDED PRODUCT

Register your .ao domain

Secure your company name before someone else registers it. from $33.30/yr

Search a domain
Was this answer helpful? Your answer helps us improve this article.