Why one resolver sees the old address
DNS updates are not a single worldwide switch. A recursive resolver can answer from its cache while an authoritative nameserver already serves the new record. TTLs influence how long cached data can remain usable; lowering a TTL after an answer was cached does not retroactively shorten that stored lifetime.
DNStracr compares authoritative, recursive and DNS over HTTPS evidence. That helps you see whether disagreement is among cached views, at the authoritative layer, or the result of a query failure.
Example: an expected transition
These fictional observations illustrate a planned migration, not a guaranteed propagation timetable. The resolver's remaining TTL is part of the explanation; waiting a fixed number of hours is not a diagnosis.
www.example.com · A
Authoritative: 192.0.2.20
Resolver A: 192.0.2.10 · cached answer
Resolver B: 192.0.2.20
Later: configured resolvers return the intended answer- Confirm the intended answer directly against authoritative evidence.
- Inspect which recursive or DoH sources disagree and whether the difference is allowed by the monitor.
- Keep missing records and query errors visible; they are different from two valid addresses.
- Follow repeated observations and recovery rather than accepting the first successful response.
When waiting is the wrong response
Unexpected differences between authoritative servers, a broken delegation, an absent required record or repeated query errors need investigation. A timer alone will not correct those conditions. Check the provider configuration and the evidence for the particular hostname and record type.
CDN and GeoDNS answers may legitimately vary even after a migration settles. Configure expected variation for those resources. Allowing variation should not hide missing answers or unexpected authoritative disagreement.
Sampling is not worldwide coverage
Selected sources do not represent every network, cache or user location. DNS observations cannot establish that all users reached the new application or that the application is healthy.
The free scan samples up to two nameservers and one parent nameserver. It is a snapshot, not a global propagation test. Continuous comparisons and incident history require enabled monitors.
Technical reference: Caching and TTLs — RFC 1034. Reviewed 10 October 2026.
Put this into practice
- Read DNS sources and results — Compare nameserver and resolver results before deciding whether to wait.
YOUR NEXT STEP
Start with a public DNS snapshot.
Run a one-time nameserver, DNSSEC and email DNS scan. It needs no account and does not establish propagation progress or the cause of an incident. For ongoing comparisons and recovery evidence, create an account and enable monitoring.
Scan your domain free ↗The scan is a single public snapshot. It does not create monitoring or a timeline.
Create your free accountFree plan: 3 domains, 15 active monitors and 1 member per organization. Minimum check interval: 60 minutes. Paid plans and checkout are not available.