DNS propagation checker
Check DNS record propagation in real time across 8 global Anycast resolvers to ensure zero-downtime domain cutovers.
Verify global DNS record synchronization
DNS propagation convergence estimator
Estimate how long downstream recursive resolvers and visitor devices will cache stale records based on your previous zone TTL.
Queries Google, Cloudflare, NextDNS, AdGuard, Alibaba, and DNS.SB public Anycast resolvers via secure DNS-over-HTTPS (DoH).
How global DNS propagation works
When you add or update a DNS record on your domain registrar or authoritative nameserver, the update is immediately written to your master zone file. However, recursive DNS resolvers across Internet Service Providers (ISPs), mobile carrier networks, and public Anycast networks do not poll nameservers continuously. Instead, they cache existing records for the duration dictated by the record’s TTL (Time To Live) value.
This checker performs parallel DNS-over-HTTPS (DoH) queries directly against 8 major global Anycast recursive networks located in North America, Europe, and Asia-Pacific. Disagreements between resolvers indicate that a zone update is actively propagating, allowing network engineers to verify convergence before announcing major network cutovers.
Global Anycast DNS resolvers benchmark matrix
| Resolver network | Primary Anycast IP | Routing architecture | EDNS client subnet (ECS) | Typical global latency |
|---|---|---|---|---|
| Google Public DNS | 8.8.8.8 | Global BGP Anycast (100+ POPs) | Supported (ECS Enabled) | 10 - 45 ms |
| Cloudflare Standard | 1.1.1.1 | Global BGP Anycast (300+ cities) | Disabled (Privacy-first) | 5 - 25 ms |
| Cloudflare Security | 1.1.1.2 | Global Security Anycast (Malware blocking) | Disabled | 10 - 30 ms |
| NextDNS Anycast | 45.90.28.0 | Global Ultra-low Latency Anycast | Supported | 12 - 40 ms |
| AdGuard DNS | 94.140.14.14 | Global Distributed Anycast | Disabled | 15 - 50 ms |
| Alibaba Cloud DNS | 223.5.5.5 | Asia-Pacific & Global Anycast | Supported | 20 - 80 ms |
Captive portal DNS propagation and walled garden mechanics
For guest WiFi deployments across venues, hotels, retail centers, and enterprise campuses, DNS reliability is critical. When a visitor connects to a WiFi access point, the wireless LAN controller (WLC) intercepts early DNS and HTTP traffic to trigger the captive portal login flow:
- Captive Network Assistant (CNA) Probes: Mobile operating systems automatically issue DNS requests for probe domains (such as
captive.apple.comon iOS andconnectivitycheck.gstatic.comon Android). - Pre-Authentication Walled Garden: The network controller must allow unrestricted DNS resolution for your captive portal hostname, payment gateways, and social login OAuth providers before the visitor authenticates.
- DNS TTL Pre-Staging: When migrating captive portal URLs or SSL certificates, network engineers must lower the zone TTL to 300 seconds (5 minutes) at least 24 to 48 hours in advance to prevent client-side connection timeouts during cutover.
Frequently asked questions about DNS propagation
What is DNS propagation and why does it take time?
DNS propagation is the timeframe required for updates made on authoritative nameservers to be distributed and updated across recursive DNS resolvers globally. When a DNS record is modified, intermediate caching resolvers (such as ISP resolvers, public resolvers like Google and Cloudflare, and corporate forwarders) retain the old record until its Time To Live (TTL) expires. Propagation typically takes between a few minutes and 24 hours depending on the pre-configured TTL.
Why do guest WiFi captive portals break during DNS propagation?
When a guest device connects to an open or secure guest SSID, operating systems like iOS, macOS, Android, and Windows initiate automated captive portal detection probes (such as querying captive.apple.com or connectivitycheck.gstatic.com). The access point or controller intercepts HTTP traffic and redirects the client browser to the captive portal domain (e.g., portal.purple.ai). If the client device uses a DNS resolver that has not yet cached the new portal record, DNS resolution fails, causing captive network assistant (CNA) browser timeouts and onboarding failures.
How does DNS TTL affect propagation speed across ISP resolvers?
TTL (Time To Live) is a 32-bit integer in seconds defined on each DNS resource record specifying how long recursive resolvers are permitted to cache the answer. A lower TTL (such as 300 seconds) ensures that resolvers query the authoritative nameserver every 5 minutes, allowing rapid cutovers. A high TTL (such as 86,400 seconds / 24 hours) causes resolvers to serve stale cached records for up to a full day.
What is the difference between authoritative DNS and recursive DNS resolvers?
Authoritative nameservers hold the master zone file and definitive source of truth for a domain (e.g., AWS Route 53, Cloudflare DNS, NS1). Recursive DNS resolvers (such as Google 8.8.8.8, Cloudflare 1.1.1.1, and ISP nameservers) act as intermediaries that query authoritative servers on behalf of client devices and cache the results according to the record TTL.
How can network engineers flush local DNS cache to verify propagation?
On macOS, run `sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder` in Terminal. On Windows, run `ipconfig /flushdns` in Command Prompt. On Linux, restart systemd-resolved via `sudo systemd-resolve --flush-caches` or `sudo resolvectl flush-caches`. Alternatively, use this online DNS propagation checker to query external Anycast resolvers directly, bypassing all local operating system caching.
Why does Purple recommend Anycast DNS and pre-configured walled garden domains?
Purple operates globally distributed Anycast cloud infrastructure that delivers sub-20ms DNS resolution and instant HTTPS splash page loading worldwide. Pre-configuring walled garden domain whitelists and lowering DNS TTLs prior to onboarding cutovers ensures seamless guest authentication across Cisco Meraki, Aruba, Ubiquiti UniFi, Ruckus, and Cisco Catalyst hardware.
Related network diagnostic and WiFi tools
Related WiFi tools
Migrating a captive portal domain?
Domain cutovers and DNS propagation can cause guest WiFi downtime if not managed carefully. Purple provides high-availability Anycast portal hosting, automated SSL certificate management, and pre-built hardware integrations for zero-downtime visitor onboarding.
Book a 20-min demoNetforge Network Multi-Tool
Run offline network health checks, path analysis, and latency diagnostic scans directly from your desktop.
Download Multi-Tool