DNS propagation tool

When you change a DNS record — updating an A record for a hosting migration, switching MX providers, or transferring nameservers — changes do not reach every resolver on the internet at the same time. The DNS propagation tool shows you the current state at 20 global resolvers and compares them against the authoritative answer for your domain.

Find it on the domain detail page under Diagnostics → DNS propagation, or navigate directly to /domains/<id>/propagation.

What it checks

Select a record type using the pill controls at the top — A, AAAA, CNAME, MX, TXT, or NS. DomainCare queries all 20 resolvers in parallel and compares each response against the authoritative answer from your domain's own nameservers.

Authoritative ground truth

Before classifying each resolver, DomainCare fetches the authoritative answer directly from your domain's own nameservers. It iterates each NS hostname, tries each public IP, and returns the first valid response along with the current TTL.

The authoritative answer appears in a prominent card at the top of the results panel. If your nameservers are unreachable or return an error, the card shows an amber warning — resolver classifications still run but may be less accurate.

The 20 global resolvers

20 resolvers across 6 continents. Each query retries up to 3 times with a 3-second timeout before being marked as an error.

Migration classification

Each resolver response is classified into one of 5 states:

For IP and hostname records, matching is exact. For TXT records (including SPF and DKIM), matching is a substring check to handle record splitting across multiple strings.

Setting old and new values

Enter your previous value (the record before the change) in the Previous value field and your target value in the Expected value field. DomainCare uses these to classify each resolver as updated, still old, or other.

If you leave both fields blank, DomainCare auto-fills the expected value from the authoritative answer. The classification still works — resolvers matching the authoritative answer are marked as Updated.

The world map

Resolver locations appear as coloured pins on a world map:

• Green — Updated
• Amber — Still old or Other
• Red — No answer or Error
• Grey — Query in progress

The map gives a quick geographic overview of propagation spread — useful for confirming that a regional incident ("site down from Brazil") is a DNS split-brain rather than an application problem.

Migration progress bar

Below the map, a segmented progress bar shows the count breakdown: updated / stale / other / unreachable. A text summary reads:

✓ 18 updated · ⏳ 2 still old

An ETA hint estimates when stale resolvers will refresh based on the TTL of the authoritative answer:

Stale resolvers refresh within ~5 min (TTL upper bound)

Auto-refresh

Use the Auto-refresh dropdown to repeat the check automatically every 1, 5, or 10 minutes. This is useful during active migrations where you want to watch propagation progress without clicking manually.

A per-org rate limit of 5 seconds between manual checks prevents hammering upstream resolvers. Auto-refresh is capped at a 1-minute minimum.

Special states

Load balanced — all resolvers responded but values differ (round-robin or GeoDNS). This is normal for load-balanced deployments. The distinct value count is shown as an informational note rather than an error.

Diverged — some resolvers returned errors or empty responses while others returned valid answers. Usually indicates propagation still in progress or a broken resolver.

Common questions

Why can't I check an arbitrary domain? The propagation tool is scoped to domains you have added to your account. This prevents abuse and ensures the "authoritative ground truth" lookup is relevant to your configuration.

My authoritative nameservers are unreachable — what now? This can happen during a nameserver transfer when old NS records are still cached. The tool falls back to classifying based on the expected/previous values you entered.

A resolver shows "Error" — is something broken? Errors usually mean the resolver is rate-limiting requests from our egress IP range, not that your DNS is broken. ISP resolvers are excluded from the list for this reason. If multiple resolvers in different regions show errors, investigate your authoritative nameserver.