When you update a DNS record — changing an A record, switching nameservers, or adding a new MX entry — those changes don't appear everywhere simultaneously. The update must travel from your authoritative nameserver to caching resolvers around the world. Checking DNS propagation means verifying that the new record values are being served consistently across multiple resolvers and geographic locations.
A DNS change is considered fully propagated when all major resolvers worldwide return the new record values. In practice, this means most queries globally return the updated data — not that every single resolver has flushed its cache.
Why Propagation Checking Matters
Without checking propagation you may be troubleshooting a problem that only exists for a subset of users. A visitor in Europe might still see the old IP address while someone in the United States already resolves to the new one. Propagation checking lets you pinpoint where the old record is still cached and estimate when the rollout will be complete for all users.
Common scenarios that require propagation checks include domain migrations, switching hosting providers, configuring email by adding MX records, and adding or changing CNAME records for subdomains.
Step 1 — Use an Online Propagation Checker
The fastest way to check propagation from multiple locations simultaneously is to use an online tool. The ShowDNS DNS Propagation Checker queries your domain against resolvers across dozens of global locations and displays which ones have the new record and which still serve the old value.
- Navigate to the DNS Propagation Checker.
- Enter your domain name in the search field (e.g.
example.com). - Select the record type you changed: A, AAAA, MX, CNAME, TXT, or NS.
- Click Check Propagation.
- Review the world map and results table. A green tick means the resolver returns the new value; a red cross means it still serves the old one.
You can also use the ShowDNS DNS Lookup tool to query a specific record type against a chosen resolver and inspect the full answer section, including TTL values.
Step 2 — Check Propagation with dig
The dig command-line tool is available on Linux, macOS, and Windows (via WSL or BIND tools). It lets you query any DNS resolver directly, bypassing your local cache.
Query your domain's A record against the default system resolver:
dig example.com ATo check what Google's Public DNS (8.8.8.8) currently serves — useful for confirming propagation from a well-known global resolver:
dig example.com A @8.8.8.8
# Also useful — check Cloudflare's resolver (1.1.1.1)
dig example.com A @1.1.1.1
# Check an MX record globally
dig example.com MX @8.8.8.8
# Check TXT records (SPF, DKIM, domain verification)
dig example.com TXT @1.1.1.1
# Check NS records to verify nameserver propagation
dig example.com NS @8.8.8.8In the output, look for the ANSWER SECTION. The IP address or record value shown there is what that resolver currently has cached. The number immediately before the record type is the remaining TTL in seconds — how much longer this resolver will keep the current value before re-querying.
Step 3 — Use nslookup for a Quick Check
nslookup is available on Windows, macOS, and Linux without additional software. It is less detailed than dig but useful for a quick sanity check.
# Query using the system default resolver
nslookup example.com
# Query against a specific resolver (Cloudflare)
nslookup example.com 1.1.1.1
# Query against Google Public DNS
nslookup example.com 8.8.8.8Step 4 — Check Specific Record Types
Different record types propagate at different speeds depending on their TTL settings. Use the appropriate query for each:
| Record Type | dig Command | Common Use |
|---|---|---|
| A | dig example.com A @8.8.8.8 | IPv4 address for a hostname |
| AAAA | dig example.com AAAA @8.8.8.8 | IPv6 address for a hostname |
| MX | dig example.com MX @8.8.8.8 | Mail server routing |
| CNAME | dig www.example.com CNAME @8.8.8.8 | Subdomain alias |
| TXT | dig example.com TXT @8.8.8.8 | SPF, DKIM, domain verification |
| NS | dig example.com NS @8.8.8.8 | Authoritative nameservers |
Step 5 — Interpreting Propagation Results
When reading propagation results, keep in mind what each status indicates:
- New value returned — the resolver has the updated record. Traffic from users whose ISP uses this resolver will reach the new destination.
- Old value returned — the resolver still has the previous record cached. It will re-query the authoritative server after its cached TTL expires.
- NXDOMAIN — the resolver returns "no such domain." This may mean the record was deleted, or the resolver has not yet received the new positive response.
- SERVFAIL — the resolver encountered an error querying the authoritative server. This warrants further investigation of your nameserver configuration.
Before checking propagation, confirm the authoritative nameserver itself is returning the correct new value. Run dig example.com A +trace to walk the full delegation chain and see exactly what your authoritative server serves. If the authoritative answer is wrong, propagation will spread the wrong record.
Step 6 — Verify TXT Records
TXT records are commonly used for email authentication (SPF, DKIM) and domain ownership verification. Use the ShowDNS TXT Lookup tool to check TXT record propagation with a clean interface, or use dig:
# Check TXT records from Google DNS
dig example.com TXT @8.8.8.8
# Check TXT records from Cloudflare DNS
dig example.com TXT @1.1.1.1
# Verbose output showing full answer section
dig example.com TXT @8.8.8.8 +noall +answerHow Long Should You Wait?
Propagation speed depends primarily on the TTL of the record you changed. If the old record had a TTL of 3600 seconds (one hour), resolvers that cached it will continue serving the old value for up to one hour before checking again. Most standard changes propagate within 1–4 hours; nameserver changes can take up to 24–48 hours due to the additional delegation chain involved.
If propagation appears stuck well beyond the TTL window, consult the guide on fixing DNS propagation issues.
Frequently Asked Questions
How do I know when DNS has fully propagated?
DNS is considered fully propagated when the overwhelming majority of resolvers globally return the new record value. Use the DNS Propagation Checker to see a real-time snapshot across many locations. Expect some stragglers — a small number of ISP resolvers may cache for longer than the stated TTL.
Why does my browser still show the old site even though propagation looks complete?
Your browser and operating system each maintain their own DNS cache, separate from your ISP's resolver. Flushing your local DNS cache and restarting the browser will force a fresh lookup. See the DNS cache flushing guide for platform-specific instructions.
Can I speed up DNS propagation?
You can reduce the propagation window by lowering the record's TTL before making the change. Set the TTL to 300 seconds (5 minutes) at least an hour before the change so most resolvers adopt the shorter TTL before you switch. Once the change is live and confirmed, you can raise the TTL back to a higher value.
What is the difference between checking propagation and checking a DNS lookup?
A DNS lookup queries a single resolver and shows you what that resolver returns. Propagation checking queries many resolvers in different countries simultaneously, giving you a global view of how far the new record has spread. Use the DNS Lookup tool for targeted single-resolver checks and the DNS Propagation Checker for global coverage.
Do all record types propagate at the same speed?
No. Propagation speed is determined by the TTL set on each record, not the record type itself. However, NS record changes tend to take longer because they involve both the parent zone (the registry) updating its delegation and the new nameservers being recognized, which adds additional TTL layers to the process.