Why DNS changes take time to be seen
Nothing pushes a DNS change out to the internet. Your authoritative servers simply start giving the new answer, and every recursive resolver in the world keeps using whatever it cached until that copy's TTL expires. A record with a 3600 second TTL can therefore be correct at the source and still wrong at a resolver for up to an hour, with each resolver expiring on its own schedule depending on when it last asked.
Negative answers are cached too. If you created a name that did not exist before, a resolver that recently answered NXDOMAIN for it keeps saying so for the time set by the SOA minimum field (RFC 2308). Nameserver changes are slower again, because the NS records that matter are held in the parent zone and the TLD's TTLs are typically long.
How the comparison is built
The tool walks up the name until it finds a zone with NS records, takes the first four nameservers, resolves each to a public IPv4 address and sends the query straight to it. The first server to answer with records (or a confirmed empty NODATA) becomes the reference. Each of the 14 resolvers is asked the same question with a timeout of a few seconds, and its answer set is normalised (lowercased, trailing dots removed, sorted) before being compared with the reference.
Propagation is the share of compared resolvers whose answer set equals the reference. Resolvers that timed out or errored are left out of that figure and shown with a dash in the Matches column. Consistency counts how many distinct answer sets exist among the resolvers that replied, which is useful even when no authoritative server could be reached.
Reading the tables
The authoritative table lists each nameserver with the IP that was queried, a status pill, the answer and the response time. OK means records came back; NODATA means the name exists but has no record of this type; NXDOMAIN means the name does not exist on that server; TIMEOUT and ERROR mean the server did not give a usable reply. Two authoritative servers giving different answers is a zone transfer problem on your side, not a propagation delay.
The resolver table adds the resolver's location and a TTL column, which is filled only for A and AAAA lookups because the resolver library reports TTLs for address records alone. MX answers appear as priority and hostname, NS answers are lowercased, and TXT strings are joined. If the authoritative answer could not be obtained, the Propagation tile shows n/a and every Matches cell shows the not-compared dash.
What a mismatch usually means
Work through the possibilities in order. If the authoritative table shows the old value, fix the zone. If the authoritative table is right and a resolver differs with a TTL still counting down, wait. If a resolver returns NXDOMAIN for a name that exists, it is negative caching, which also expires. If several resolvers return different addresses and the domain uses a CDN, that is geography, and the info box above the tables says so.
A resolver that times out on every check is sometimes just unreachable from the server running the test, particularly resolvers located behind national filtering. Treat a single TIMEOUT row as noise and re-run the check before reading anything into it.
- Authoritative servers disagree with each other: check the SOA serials with Domain DNS Validation.
- All resolvers agree but differ from authoritative: the old TTL has not expired yet. Note the longest remaining TTL in the table.
- One resolver shows ERROR or SERVFAIL for a signed zone: compare DS and DNSKEY with DS Record Lookup.
- Mixed answers for a bare domain that is not on a CDN: an authoritative server is probably stale.
Planning a change so there is nothing to wait for
Lower the TTL of the record you intend to change at least one old-TTL period before the change, to 300 seconds or less. Make the change, confirm it here, and raise the TTL again once every resolver matches. Keep the old server running and serving the same content until the check reads 100 percent, since clients will keep arriving there until then. For a nameserver move, run both providers with identical zones for a day or two before removing the old NS records.
Limits of a 14-resolver check
These 14 resolvers are a sample, chosen across providers and regions, not the whole internet. Your visitors mostly use their ISP's resolver, which is not in the list and may be slower to expire. The authoritative check queries at most four nameservers and only over IPv4. For the full set of records at a name, use DNS Lookup. To confirm the new address actually answers, use Ping. Queries are not stored.