DNS
DNS changes: compare the source and recursive caches
Read Cloudflare DNS results without treating a TTL as a global propagation timer.
A result is one observation
DNS Lookup asks Cloudflare’s recursive DNS-over-HTTPS resolver from your browser. Cloudflare receives the queried name and your connection’s public IP. The answer may come from its cache. It does not query your ISP’s DNS cache or prove that every user sees the same answer.
Record the exact name, record type, resolver and observation time. A TXT at example.com and a TXT at _dmarc.example.com are different queries. This tool supports one of A, AAAA, CNAME, MX, NS, TXT, SOA or SRV per request; it has no ALL option.
A repeatable check
Use openpdf.app, a public domain operated alongside PingThat, to inspect a real response without entering a private target:
curl --header 'accept: application/dns-json' \
'https://cloudflare-dns.com/dns-query?name=openpdf.app&type=A'In DNS Lookup, enter openpdf.app and choose A. Compare Status and the records in Answer with the terminal response. Do not expect a fixed IP address or identical TTL: the queries happen at different times and can reach different resolver caches. The command contacts Cloudflare directly, just like this tool.
| Response | Interpretation | Next check |
|---|---|---|
| Status 0 with answers | The resolver returned records | Compare the exact name and values with the intended configuration |
| Status 0 without answers | No records in the answer section for this request | Check the type and name; this does not prove the entire domain is absent |
| NXDOMAIN, status 3 | The name or an alias target is reported absent | Check spelling and the authoritative zone; a negative answer can be cached |
| SERVFAIL, status 2 | Resolution failed | Investigate upstream availability, delegation and DNSSEC; do not describe this as “no records” |
| REFUSED, status 5 | The query was refused | Retry only if appropriate and check the provider’s restrictions |
| HTTP error or timeout | No usable DNS response reached the tool | Check network access; this is not evidence about the requested record |
Compare source data before waiting
For a domain you manage, check that the intended change exists at its authoritative nameservers. If they disagree, investigate zone publication, delegation or secondary synchronization. PingThat’s basic lookup is recursive; it does not silently switch to an authoritative server.
Then use Resolver Compare to sample other recursive answers. Agreement is useful evidence for those resolvers at those times, not a worldwide completion certificate. Browsers, applications and operating systems can also keep their own caches.
TTL is not a worldwide deadline
A cached answer can show the remaining cache lifetime in seconds. Lowering the source TTL cannot retroactively shorten a value already cached elsewhere. Before a planned change, lower it early enough for the previous TTL to expire, check that the change has reached the authoritative servers, and keep the previous service available as appropriate for your migration.
There is no universal 48-hour rule. Delegation and DS changes involve parent-zone data and their own publication and caching. Resolver policies also differ; stale-answer mechanisms can serve expired data under specific failure conditions. A displayed TTL alone cannot promise when every user will switch.
Negative caching and DNSSEC
NXDOMAIN and successful answers without the requested data can be cached too. RFC 2308 defines the negative-cache TTL from the smaller of the SOA record’s TTL and its MINIMUM field. A name created after a negative answer was cached can therefore remain absent from that cache temporarily.
SERVFAIL is not a DNSSEC diagnosis by itself. A broken chain of trust is one possible cause alongside network and server failures. Check the parent DS and zone DNSKEY/signatures with a dedicated DNSSEC diagnostic; ordinary WHOIS/RDAP output is not proof that the chain validates. Follow your DNS provider’s migration and key-rollover procedure rather than disabling validation to hide an error.
Sources and limits
- Cloudflare: JSON DNS-over-HTTPS interface.
- RFC 1035, DNS response codes and records.
- RFC 2308, negative caching.
- RFC 8767, serving stale DNS data.
This workflow checks an observation, not your entire DNS configuration. See methodology for the providers contacted and privacy for recent queries and shareable URLs.