DNS propagation and routing checksWhat it checks and how to fix it

What it checks

Queries the domain's A records on the Google (8.8.8.8), Cloudflare (1.1.1.1) and Quad9 (9.9.9.9) public resolvers. Passes when all three return the same set of addresses, and warns when one of them fails to resolve the domain or they disagree.

Why it matters

When public resolvers return different addresses, visitors reach a different server depending on which resolver their ISP or device uses: some see the new site, others the old one or nothing at all. Right after a DNS change this is normal propagation, but if it persists it points at a stale record, nameservers serving different versions of the zone, or a misconfigured geo-DNS setup.

How to fix it

If you changed DNS recently, wait for the old record's TTL to run out and audit again. If the answers still differ, compare what each of your authoritative nameservers returns: they must all serve the same zone.

dig +short A example.com @8.8.8.8
dig +short A example.com @1.1.1.1
dig +short A example.com @9.9.9.9

dig +short NS example.com
dig +short A example.com @ns1.dns-provider.net
dig +short A example.com @ns2.dns-provider.net

• A nameserver returning old data usually means a secondary that no longer receives zone transfers, or a provider you moved away from that is still listed at the registrar. Fix or remove it from the delegation.
• Before a planned migration, lower the record's TTL (for example to 300 seconds) a day in advance so the switch propagates quickly.