Compare one DNS record at Cloudflare and Google side by side, with DNSSEC on and off
Runs in your browser. Only the lookup you start is sent to cloudflare-dns.com or dns.google; nothing else leaves your device. Updated on 24 Oct 2026.A DNS propagation check asks more than one resolver for the same record and compares the answers. This one asks 2 large public resolvers, Cloudflare and Google, each with DNSSEC checking on and off, and says whether they agree. A difference is almost always an old cached copy that expires within its TTL.
Choose the record that changed in the Record type list, such as A, MX or TXT.
Type the domain name and press Compare.
Read the headline: it says whether Cloudflare and Google return the same answer.
Turn on Show answers with DNSSEC checking off to see whether a DNSSEC failure is hiding the record.
Press Copy comparison to copy both answers with their TTLs.
This DNS propagation checker sends the same question, for example the A record of your domain, to two public resolvers at once: Cloudflare 1.1.1.1 and Google 8.8.8.8. Each is asked twice, once normally and once with DNSSEC checking turned off, so four answers sit side by side with their TTLs. A line at the top says whether the two resolvers agree, and what each has that the other does not.
DNS changes do not spread out across the world. The moment you save a record, your DNS host's servers answer with the new value. What lags is the copies: every resolver that asked before your change keeps its cached answer until that answer's TTL runs out, then asks again. So "not propagated yet" means "a cache still holds the old copy", and the TTL shown on that copy is the longest it can last. Lowering a TTL a day before a planned change makes the change visible faster.
A name that did not exist before is a special case. Resolvers also cache "this name does not exist", for the number of seconds in the last field of the zone's SOA record, which is why a new subdomain can stay invisible even after the record is added.
Two resolvers are two caches out of many thousands run by internet providers, companies and phones. Agreement between them is a good sign, not proof that everyone sees the new value; your own provider's resolver may still hold an old copy. Checking more locations needs servers in those places, which a page running in your browser does not have.
The DNSSEC comparison catches a failure that looks like an outage. When the answer is SERVFAIL with checking on but the records appear with it off, the zone's signatures do not validate, usually because the DS record at the registrar no longer matches after a change of DNS host. The name you type is sent to both resolvers to answer it; nothing else leaves your device.
As long as the old record's TTL, at most. A resolver that cached the old answer keeps it for that many seconds and then asks again. A record with a TTL of 3600 is fully replaced within an hour; one with 86400 can take a day. Name server changes at the registrar can take up to two days.
Usually one of them cached the old value before you changed it and has not reached the end of its TTL. Some names also answer differently on purpose, depending on where the question comes from, such as CDNs and load balancers. Wait for the TTL shown, then check again.
No. Two public resolvers are two caches out of many thousands run by internet providers and companies. Agreement is a good sign that the authoritative answer is right. Any other resolver that cached the old value still holds it until that copy's TTL runs out.
The zone's DNSSEC signatures do not validate. Validating resolvers, including Cloudflare, Google and many internet providers, refuse the name entirely, so visitors see it as down. The usual cause is a DS record at the registrar that no longer matches the zone's keys after a change of DNS host.
The name and record type go to both Cloudflare at cloudflare-dns.com and Google at dns.google, because comparing them is the point of the page. The requests run from your browser. This site never receives the name, and nothing else about you leaves your device.
Still stuck? Ask about DNS Propagation Checker and anybody who knows can answer. No account needed.
Same job, other tools: AAAA Record Lookup (IPv6) – Check whether a domain has an IPv6 address, and what it is · CAA Record Lookup – See which certificate authorities a domain allows to issue its SSL certificates · DNSKEY Lookup – List a zone’s DNSKEY records with key tags, KSK or ZSK roles, algorithms and key sizes.
On the related tools: Open Port Checker – See if a port forwarded on your router is reachable from the internet.