AWebsiteThe site still shows the old host
If both resolvers already return the new IP, the old copy is on your computer: flush it, or try mobile data. On Windows the command is ipconfig /flushdns. If they don't, wait out the TTL shown.
DNS · 1.1.1.1 · 8.8.8.8
DNS lookup that asks two resolvers at once.
Check the A, AAAA, CNAME, MX, TXT, NS, CAA or SOA records of any domain. Cloudflare and Google Public DNS answer the same question side by side, so you can see whether a change has reached both, with every TTL and the DNSSEC status.
8 record types + reverse DNS
DNS over HTTPS
No lookup history
Look up DNS records
Pick a record type, enter a domain or hostname, and both resolvers are asked at the same moment. Enter an IP address instead to get its reverse DNS (PTR) name.
Results appear hereDNS over HTTPS
1.1.1.1 Cloudflare
8.8.8.8 Google Public DNS
Changing the record type re-runs the query, so you can step through A, MX and TXT for the same name in a few clicks. A link to the results keeps the name and type, which is handy for a support ticket.
DNS guide
Read a DNS answer like the person who set it up.
Record types and when to check each
Each lookup asks for one record type on one name. Start with the type that matches the symptom:
| Type | Check it when | Example answer |
|---|---|---|
| A | The site won't load, or still shows the old host | 203.0.113.24 |
| AAAA | Some visitors, often on mobile data, reach a different server | 2001:db8::24 |
| CNAME | www or a subdomain should follow another name | yourbrand.in. |
| MX | Email isn't arriving at all | 0 mail.yourbrand.in. |
| TXT | Mail lands in spam, or a service can't verify the domain | "v=spf1 +a +mx ~all" |
| NS | You changed nameservers, or edits seem to do nothing | ns1.yourhost.net. |
| CAA | An SSL certificate won't issue | 0 issue "letsencrypt.org" |
| SOA | You need the zone's serial or its negative-cache time | ns1.yourhost.net. … 3600 |
| PTR | Mail sent from your VPS is rejected for missing reverse DNS | mail.yourbrand.in. |
For what each record does and how to add one in cPanel's Zone Editor, see DNS records explained, with copy-ready examples.
Propagation and TTL: why a change takes time
DNS changes don't travel outwards like a wave. Your nameservers give the new answer the moment you save it, but resolvers such as 1.1.1.1, 8.8.8.8 and your internet provider's keep serving the copy they cached until its TTL (time to live, in seconds) runs out. "Propagation" is simply those caches expiring one by one, which is why the TTL shown next to every answer matters.
| What changed | How long it usually takes |
|---|---|
| An existing A, CNAME, MX or TXT record | Up to the old TTL: five minutes at 300, an hour at 3600 |
| A brand-new record | Minutes, unless someone looked it up before it existed: that "no such record" answer is cached for the zone's negative TTL, the last number in the SOA |
| Nameservers, at the registrar | A few hours, sometimes 24–48 hours, because the registry's own NS records carry long TTLs |
| DNSSEC switched on or off | Plan for a day or two; a stale DS record at the registry causes SERVFAIL |
To make a planned change land in minutes rather than hours:
- Shorten the TTL a day ahead. Lower the record's TTL to 300 seconds, then wait at least as long as the old TTL so every cache picks up the short one.
- Make the change and look it up here. When both resolvers return the new value, the large public caches have it, and other resolvers follow within the same five minutes.
- Put the TTL back. Once everything works, raise it to 3600 or more again, so resolvers don't have to ask your nameservers so often.
For a fuller walk-through, including checking from your own computer, read how to check DNS propagation.
Why Cloudflare and Google can disagree
A difference between the two columns isn't automatically a fault. In rough order of how common they are, the causes are:
- One still has the old answer cached. This fixes itself: the TTL shown is the time left on that copy, so a resolver with 2,140 seconds to go switches in about 36 minutes.
- They reached different cache nodes. Both services run many sites around the world, each with its own cache, so even one resolver can give two answers a minute apart while a change settles.
- The site uses a CDN or geo-routing. Large sites hand out addresses by location, so two different answers can both be right. We ask Google without your network's location hint (ECS) to keep the comparison fair, but CDNs can still vary.
- A recent DNSSEC or nameserver change. SERVFAIL on one side only usually means that resolver still holds the old DS or NS data. If both fail, see the table of results below.
Several A records coming back in a different order isn't a difference: round-robin DNS shuffles them on purpose, and the tool sorts answers before comparing.
Troubleshooting email: MX, SPF, DKIM and DMARC
When mail stops arriving or starts landing in spam, DNS is the first place to look. Run these four lookups in order:
- MX on the bare domain. Enter yourbrand.in and choose MX. You should see your mail provider's servers, and the lowest number is tried first. Each MX target must be a hostname with its own A record, never an IP address or a CNAME.
- SPF: TXT on the bare domain. Look for exactly one record that starts
v=spf1. Two SPF records make both invalid, so merge them: a cPanel site that also sends through Google Workspace needsv=spf1 +a +mx include:_spf.google.com ~all. Microsoft 365 usesinclude:spf.protection.outlook.com. SPF allows at most 10 DNS lookups, so drop includes you no longer use. - DKIM: TXT on the selector. Every sender signs with a selector: cPanel uses
default, so look updefault._domainkey.yourbrand.in; Google Workspace usesgoogle. A missing or cut-off key makes signed mail fail the check. - DMARC: TXT on _dmarc. Look up
_dmarc.yourbrand.in. A record such asv=DMARC1; p=none; rua=mailto:[email protected]is a safe start: it sends you reports without blocking anything. Tighten the policy toquarantineonly once SPF and DKIM pass for everything you send.
To create or fix these records step by step, follow how to set up SPF, DKIM and DMARC in cPanel.
Sending from a VPS?Also check reverse DNS: enter the server's IP address and the PTR answer should be a hostname whose A record points back to that same IP. Many mail servers reject mail from addresses without one. Setting up mailboxes instead? See create an email account in cPanel.
NXDOMAIN, SERVFAIL and empty answers
The coloured label on each resolver's column is the DNS response code. This is what each one means:
| Result | Meaning | Next step |
|---|---|---|
| NOERROR | The name resolves and records came back | Compare the values with what your host or mail provider gave you. |
| NOERROR · empty | The name exists but has no records of this type | Normal for AAAA on IPv4-only sites. Otherwise, add the missing record. |
| NXDOMAIN | The name doesn't exist at all | Check the spelling, then run a WHOIS lookup: expired, held and undelegated domains all return this. |
| SERVFAIL | The resolver couldn't get a valid answer | Usually a DNSSEC mismatch, or nameservers that don't answer for the domain. |
| REFUSED | The nameservers refused the query | Rare. The servers listed aren't set up for this domain; ask your DNS host. |
Six DNS problems, and the record behind each.
Match the symptom, run the lookup shown on the card, and the answer usually points straight at the fix.
CNAMEWebsitewww works but the bare domain doesn't
The two are separate names. The bare domain needs its own A record; www is usually a CNAME to it. Look up both, and add whichever one is missing.
DNS records explainedMXEmailEmail stopped after a move
Switching nameservers moves every record at once. If the MX and SPF records weren't recreated at the new DNS host, mail has nowhere to go. Copy them across from the old zone.
Migrate without losing mailCAASSLThe SSL certificate won't issue
A CAA record that names only one certificate authority blocks the rest. AutoSSL uses Let's Encrypt or Sectigo depending on the server, so list both, or remove CAA altogether.
Turn on free SSLTXTVerificationA service can't verify the domain
Many DNS panels add the domain to the host field for you, so typing it again creates yourbrand.in.yourbrand.in. Look up the exact name the service asked for.
NSNameserversEdits don't change anything
You may be editing a zone that isn't live. An NS lookup shows which nameservers actually answer; make changes there, or switch the nameservers at your registrar.
See nameservers in WHOISMore free tools for your domain.
DNS lookup FAQs: caches, subdomains and DNSSEC.
Something else? Our support desk answers tickets around the clock, in English and Hindi, at [email protected].
When both resolvers here return the new value, the big public caches have it. Other resolvers follow the same TTL rules, so they catch up within the old TTL. After a nameserver change, allow up to 24–48 hours.
Either the domain's nameservers point somewhere other than the panel you're editing, which an NS lookup shows, or the old answer is still cached, which the TTL tells you. Fix the first by editing the live zone; the second clears itself.
Yes. Type the full name, such as mail.yourbrand.in, shop.yourbrand.in or _dmarc.yourbrand.in, and pick the record type. A web address with https:// and a path works too; the tool keeps just the hostname.
The answer wasn't signed with DNSSEC, which is the case for most domains and is harmless. "DNSSEC validated" means the resolver checked the signature chain from the registry down to the record.
Your internet provider's resolver, your router or your computer still holds an older copy. It expires on its own within the old TTL. To see the change sooner, flush the computer's DNS cache or try another network.
No. Queries go from your browser straight to Cloudflare and Google over HTTPS, without cookies or a referrer, and never reach our servers.
DNS management included
Manage DNS where your site lives.
Every domain and hosting plan includes DNS management for A, AAAA, CNAME, MX, TXT, SRV and CAA records, with DNSSEC where the registry supports it.