isitdns?

DNS change check: is the new record live

dns change check

You changed a record or moved nameservers. Which public resolvers still answer the old value, and for how long? Whether every authoritative server has the new value is the sweep's question: nameserver consistency.

isitdns.net/#dig: the same question over DoT, Do53 over TCP and UDP, IPv6, or at any public resolver address.

read
  • GO with all four selected, the new value at every row. Each row is one cache of that resolver, the one that answered the Cloudflare edge (IAD) at that instant; another location of the same resolver can still hold the old value, and this page does not read it. A name a CDN steers by location answers each resolver's location with its own set, so rows that differ with no EDE line are not by themselves an old value (the comparison page reads that case).
  • NO GO an old value at a row whose TTL counts down between two reads: that cache is still old, and stays old until read time plus its TTL (the reading below ends TTL of example.com A: 161 s at quad9 to 300 s at adguard across 4 rows with the same data) -> you: ask again after that time; nothing shortens it.
  • NO GO an old value whose TTL sits above the TTL the authority hands out (the trace prints it as auth A TTL), with the TTL unchanged by your edit: the cache was filled from an old copy, from a server that still serves one -> zone owner: nameserver consistency shows which server, and delegation trace whether the parent delegates to the servers you edited. An edit that also shortened the TTL leaves ordinary caches above the new value until they expire; that is the line above.
  • NOT RUN a TTL that does not count down between two reads: each read is one cache of that resolver, the one that answered the Cloudflare edge at that instant, and two reads can land on two caches of the same resolver. Read again; the line above is the read when the TTL sits above the authority's.
  • NOT RUN a nameserver move: this read does not show which servers a resolver asked. Resolvers keep the old delegation for the parent's NS TTL (172800 s at .com in the trace example), or for the zone's own NS TTL when they learned the set from the old provider's servers (RFC 2181 section 5.4.1), and those servers still answer -> you: keep the old zone serving the same data until both TTLs have passed.
example

example.com A at four resolvers, read 2026-10-18T22:02:05Z:

  isitdns · dig · example.com A
  ;; asked 2026-10-18T22:02:05.419Z over DoH (dnssec on) from the Cloudflare edge, not your network

  ;; @cloudflare (cloudflare-dns.com) over DoH · 8 ms · 179 bytes · NOERROR · flags: qr rd ra ad
  ;; asked 2026-10-18T22:02:05.419Z from the Cloudflare edge (IAD), remote address unavailable from this vantage
  ;; ANSWER (3)
  example.com.                     300  IN  A      104.20.23.154
  example.com.                     300  IN  A      172.66.147.243
  example.com.                     300  IN  RRSIG  A 13 2 300 20261019230205 20261017210205 34505 example.com. T1Ly4qTm5shO5THTJUTIQHBDVgLZwO1oA2WyExngg+9RUhIfsGP6fqUpBwHGTYhIxH/BMQlFW96HBM9Zw1NWhw==  ; key tag 34505, inside its window, expires 24 h after this read (the signature itself is not checked here)
  ;; EDE: none received

  ;; @google (dns.google) over DoH · 31 ms · 179 bytes · NOERROR · flags: qr rd ra ad
  ;; asked 2026-10-18T22:02:05.419Z from the Cloudflare edge (IAD), remote address unavailable from this vantage
  ;; ANSWER (3)
  example.com.                     300  IN  A      172.66.147.243
  example.com.                     300  IN  A      104.20.23.154
  example.com.                     300  IN  RRSIG  A 13 2 300 20261019230205 20261017210205 34505 example.com. GseV3CD2m6hPi2f9nIBsjY2tAXlKL+WcmWR52/q49CODwpyAk8Y157lH10apQsct9dnaDfeg6kq0i9/dCLmB4g==  ; key tag 34505, inside its window, expires 24 h after this read (the signature itself is not checked here)
  ;; EDE: none received

  ;; @quad9 (dns.quad9.net) over DoH · 19 ms · 179 bytes · NOERROR · flags: qr rd ra ad
  ;; asked 2026-10-18T22:02:05.419Z from the Cloudflare edge (IAD), remote address unavailable from this vantage
  ;; ANSWER (3)
  example.com.                     161  IN  A      104.20.23.154
  example.com.                     161  IN  A      172.66.147.243
  example.com.                     161  IN  RRSIG  A 13 2 300 20261019225946 20261017205946 34505 example.com. Q0GkpAN2fhWJGs3vmLNFS9U4vrmiIaDN/bKfqeO5I/6xBLgTUeGIaLiRVIbWtuKoaGobpaYdP5GuDDjxKYCb7Q==  ; key tag 34505, inside its window, expires 24 h after this read (the signature itself is not checked here)
  ;; EDE: none received

  ;; @adguard (dns.adguard-dns.com) over DoH · 104 ms · 179 bytes · NOERROR · flags: qr rd ra ad
  ;; asked 2026-10-18T22:02:05.419Z from the Cloudflare edge (IAD), remote address unavailable from this vantage
  ;; ANSWER (3)
  example.com.                     300  IN  A      104.20.23.154
  example.com.                     300  IN  A      172.66.147.243
  example.com.                     300  IN  RRSIG  A 13 2 300 20261019230205 20261017210205 34505 example.com. T37J3XTeT9ju32dpVFkWtgzFK2LtEg+FN/nwCMQBvljOmJqsIqNfGVEXDyxtlDyCmIVzK08n9wk5ppiX4jBr5w==  ; key tag 34505, inside its window, expires 24 h after this read (the signature itself is not checked here)
  ;; EDE: none received

  ;; same answer at cloudflare, google, quad9, adguard: NOERROR, A 104.20.23.154 172.66.147.243, AD 4 of 4

  ;; TTL of example.com A: 161 s at quad9 to 300 s at adguard across 4 rows with the same data

  browser: https://isitdns.net/dig?name=example.com&type=A&resolver=all
from your own machine
dig @1.1.1.1 example.com A
dig @8.8.8.8 example.com A
dig +norec @hera.ns.cloudflare.com example.com A

Nothing propagates: an authoritative server serves the new data or it does not, and every cache expires on the TTL it was handed (RFC 1035 section 3.2.1). The third command asks the authority with recursion off.

the manual
other jobs