How to Troubleshoot DNS Propagation

A DNS change is not a broadcast that reaches every computer at once. Your provider publishes records; recursive resolvers keep earlier answers until their applicable cache rules permit another lookup. First find out whether the correct answer was published at all.

Start here: where do answers disagree?

Finding	Next check
Authority still has the old address	Correct account, zone, record name and saved change
Authority is correct; one resolver is old	Prior TTL and that resolver’s remaining cache
Different authoritative servers disagree	Provider replication or delegation
SERVFAIL rather than an old address	DNSSEC validation, delegation and provider health

Record the full hostname, record type, old/new values and change time. Do not switch nameservers just to clear a cache.

1. Establish the authority — read only

Replace the example names. Use an authoritative server confirmed by the domain’s current delegation, not one merely shown in an unused hosting account.

Resolve-DnsName your-domain.example -Type NS
Resolve-DnsName your-domain.example -Type A -Server ns1.your-provider.example -NoRecursion
Resolve-DnsName your-domain.example -Type A -Server 1.1.1.1
Resolve-DnsName your-domain.example -Type A -Server 8.8.8.8

The public resolver addresses are optional third-party services; querying them reveals the requested hostname. Different answers can be legitimate for geographically distributed services. Confirm the intended design before treating every difference as a fault.

2. Test the name actually used

Check apex, www and IPv6 independently. An unchanged AAAA record can send IPv6 visitors to the previous host even when A is correct. A working website does not prove MX or verification records are correct. Follow the DNS record guide when separating those dependencies.

For example, authority may return a new A address while a resolver shows the previous address with 600 seconds remaining. That is consistent with caching. Repeatedly replacing the authoritative value does not remove that cached answer.

3. Distinguish missing answers from failures

NXDOMAIN means the queried name does not exist in that response; an existing name can also lack the requested record type. Negative answers can be cached. A timeout suggests reachability or server trouble, while SERVFAIL needs investigation, including DNSSEC. Lowering the new record’s TTL does not retrospectively shorten an old cached answer or negative response. Clearing one computer’s cache does not clear an ISP’s cache. Cloudflare’s troubleshooting documentation explains these distinctions.

Finish or escalate

Recheck after the relevant old cache interval and compare all delegated servers. If authoritative data is wrong, restore only the previously recorded record after confirming authorization. If delegation or DNSSEC is inconsistent, ask the DNS provider to investigate; do not remove DS records or disable validation as a shortcut. Keep the previous web/mail service available until acceptance checks pass. Next: point a domain to a website.

Official references

• Cloudflare: general DNS troubleshooting
• Microsoft: DNS query options

Documentation checked 2026-10-18. Examples use reserved names and addresses; replace placeholders only for systems you are authorized to manage. Interfaces and included features depend on your provider and account.