DNS propagation matrix: did my change reach the world yet?
You just edited an A record at your registrar. Now you sit there refreshing the browser, wondering whether the new server is live. Or you bumped an MX before a mail migration and need to know how many resolvers still hand out the old answer. This tool is built for that exact moment.
It runs one query, on one record, against 12 public DNS resolvers spread across operators and regions (Cloudflare, Google, Quad9, OpenDNS, AdGuard, Yandex, Comodo, DNS.SB, Mullvad, LibreDNS, NextDNS, PowerDNS). You get a table: each resolver, what it currently returns, and a colour cue for whether it agrees with the majority answer. A summary line at the bottom tells you in plain words: "Consistent: 12/12 agree on `1.2.3.4`" or "Pending: 4/12 still serve the old value".
Turn on auto-refresh and the page repeats the query every 30 seconds so you can keep the tab open during a migration and watch laggy resolvers catch up.
How to use it
- Type the domain you just changed (no `https://`, no path): `example.com`, `mail.acme.io`, `cdn.brand.dev`. Subdomain works too if you only changed a specific record.
- Pick the record type on the segmented bar: `A` for IPv4, `AAAA` for IPv6, `CNAME` for aliases, `MX` for mail, `TXT` for SPF/DKIM/DMARC and verification tokens, `NS` for the authoritative name servers.
- Click Check propagation. In 2 to 4 seconds you get a table with all 12 resolvers and a coloured summary card at the bottom.
- Green rows = this resolver agrees with the majority. Yellow rows = it returns a different answer (probably still cached). Red rows = the resolver failed (timeout, SERVFAIL, NXDOMAIN).
- Flip on auto-refresh and the same query repeats every 30 seconds. Useful when you want to watch the world catch up after a change without spamming the button.
- The summary card at the bottom shows the majority answer plus an "agreeing / total" count. "12/12" means full propagation. Anything less means at least one resolver is still serving an old or filtered value.
- If a single resolver consistently disagrees while the other 11 are unanimous, the issue is that resolver, not your DNS: it may filter the domain (AdGuard blocks ads, Quad9 blocks malware) or cache more aggressively.
When this is useful
Seven typical moments when "is my DNS propagated yet?" matters more than any other question:
- Right after a server move. You changed the A record from `212.x.x.x` to `185.y.y.y`. You run the matrix and refresh every minute. When 12/12 show the new IP, you can safely retire the old box.
- MX migration before a mail cutover. You move from one mail provider to another and need to be sure deliverability does not split between the two. The MX matrix shows when every resolver hands the new server out.
- CNAME pointing for a SaaS subdomain. You wired `shop.brand.com` to Shopify, the dashboard says "not pointing here yet". Check the CNAME matrix: if 12/12 show the right target, the SaaS dashboard is just slow to refresh.
- DKIM rollout. You added a TXT record at `default._domainkey.brand.com`. You query TXT: when every resolver returns the new key string, you can switch DKIM signing on without rejection bounces.
- TTL preflight. Before a big change, query the current record to confirm what is cached. If the TTL was lowered to 60 seconds yesterday, you know the rollout will be quick. If it is still 3600, allow at least an hour for cache to expire.
- Debugging "works for some users, not others". A teammate cannot reach the new site. You ask which DNS they use, you check that resolver in the matrix: if it still shows the old IP, the answer is cache, not your code.
- Spotting filtering vs propagation. Quad9 returns `NXDOMAIN` for one of your domains while everyone else resolves it. That is filtering (malware list), not a propagation gap. The matrix makes the distinction obvious in one glance.
Related tools: DNS lookup (every record type, full detail), reverse DNS / PTR lookup (IP to hostname), WHOIS lookup (who owns the domain), DNSSEC validator (cryptographic chain of trust).