DNS Propagation Checker

The ZeoTools DNS Propagation Checker asks the same question to public resolvers on several continents and lays their answers side by side. Unlike single domain checkers it accepts a whole list of domains, so a migration of fifty zones is confirmed in one run instead of fifty. All twelve common record types are supported, from A and MX to CAA, DS, and DNSKEY, and it needs no account and no API key.

Every location label is measured, never copied. Each day every resolver is asked to reveal the address it uses to reach the internet through whoami.akamai.net. That address is placed by two independent geolocation databases, and the ping time is checked against the distance. Light in fiber needs about one millisecond for every hundred kilometres there and back, so a resolver that claims to sit in America yet replies to our server in sixteen milliseconds is removed. When the databases disagree on the city we show only the country.

Reading the answers. Resolvers that return the same records are grouped as Answer 1, Answer 2, and so on. A single group everywhere means the record is identical worldwide. Several groups do not always mean propagation is unfinished, because CDNs and GeoDNS deliberately hand out different addresses per region. When many resolvers return SERVFAIL the domain is marked as a lookup error, and the reason each resolver gives, such as a DNSSEC failure or name servers that refuse the zone, is shown beside it.

What we leave out. We query only the unfiltered editions of public resolvers, because filtering editions swap gambling, adult, or malware domains for a block address that looks like a propagation problem. Resolvers that rewrite missing domains into advertising pages are excluded too, as are open resolvers that belong to banks, universities, government offices, and other private networks. A timeout usually means that resolver filters foreign queries or is briefly overloaded, not that your zone is broken.