Skip to content
ForgePlug — Logo
developerRuns Server-SideNo Signup

DNS Propagation Checker

Query a domain's A, AAAA, MX, TXT (including SPF), and NS records from three independent public DNS-over-HTTPS resolvers — Cloudflare, Google, and Quad9 — at the same moment, and instantly see whether they agree. A record that differs between resolvers is flagged as still propagating, so you know whether to wait or investigate. Part of ForgePlug's Site Health Check, which also runs SSL, HTTP security header, and robots.txt checks on the same domain at no extra cost.

This check runs server-side — ForgePlug briefly connects to the domain you enter to read its certificate, DNS records, response headers, and robots.txt/sitemap. We don't store anything beyond a 5-minute result cache (to avoid re-running the same check for everyone hitting a trending domain) and a short-lived snapshot used to compare a re-check later.

Checking DNS propagation from three vantage points

Cloudflare, Google, and Quad9, queried at the same moment.

"Is my DNS change live yet?" is hard to answer from a single lookup, because your own machine's resolver may have cached the old answer while the rest of the world has already moved on — or the other way around. This tool queries A, AAAA, MX, TXT (including SPF), and NS records from three independent public resolvers at once and compares the answers directly.

If every resolver agrees, the change has propagated. If they disagree, that record is flagged as still propagating, and you can see exactly which resolvers have the old value versus the new one instead of guessing.

Because it's part of ForgePlug's full Site Health Check, submitting also runs a TLS certificate check, an HTTP security header scan, and a robots.txt/sitemap validation on the same domain — all in parallel, at no extra cost.

Frequently Asked Questions

DNS propagation checking, explained

How does the propagation check actually work?
It queries A, AAAA, MX, TXT, and NS records from three independent public DNS-over-HTTPS resolvers — Cloudflare, Google, and Quad9 — at the same moment. If two resolvers return different answers for the same record type, that's a live sign the change is still propagating outward from your authoritative nameserver.
Why DNS-over-HTTPS instead of a normal DNS query?
This tool runs on serverless infrastructure that commonly blocks outbound UDP on port 53 (the traditional DNS port), so it queries each resolver's HTTPS JSON API instead — the same records, delivered over a protocol serverless functions can actually use.
Is this really free, and is there a limit?
Yes — Site Health Check is free and doesn't require an account. Like every ForgePlug tool it's rate-limited per IP address (a handful of checks per minute) to keep the service fast and available for everyone, not to push a paid tier.
Why does this tool need a server? Aren't ForgePlug's tools all browser-based?
Almost all of them are — but a browser can't open a raw TLS handshake, query a DNS resolver directly, or fetch another site's headers without hitting CORS. Those three things require a real network connection from a server, so this one tool runs a small, rate-limited check server-side instead of pretending it can do it client-side.
What do you do with the domain I check?
The check result is cached for 5 minutes so a burst of people checking the same trending domain doesn't trigger five fresh outbound connections each time, and the most recent result is kept briefly so a re-check can eventually show what changed. We don't log who checked what.
Can I check an internal or private server?
No — the tool refuses any hostname that resolves to a private, loopback, or link-local address (including cloud metadata endpoints) as a security precaution. Enter a public domain name, not an internal hostname or a bare IP address.
What does the overall pass/warn/fail badge mean?
It's the worst result across all four panels, not an average: two or more failing panels caps the overall badge at fail, one failing panel caps it at warn, and any warning (with no failures) also shows as warn. A clean pass means all four checks came back clean.

Guides & Articles

Learn how to get the most out of this tool with our in-depth guides.

Developer7 min

What Is a Website Health Check (And Why Does It Matter)?

A site can look fine in a browser and still be quietly broken — an expiring certificate, half-propagated DNS, missing security headers, or a sitemap full of dead links. Here's what a real health check looks for.

Aug 2026

Was this tool helpful?

Your feedback helps us improve DNS Propagation Checker for everyone.

Report an issueSuggest a feature

Share this tool

Share