Propagation and name servers

After a DNS change there are two questions: do resolvers out there already see the new data? And are the name servers themselves set up properly? That’s what DNS-Propagation and the Nameserver-Prüfung (name server check) are for. Both need a license.

DNS propagation

Propagation queries a name at many public resolvers at once and compares their answers.

1. Type the name into Name oder IP (name or IP).
2. Pick the Typ (type), for example A, MX or TXT.
3. Click Vergleichen (compare).

In the Mac app it queries 20 resolvers directly, including Cloudflare, Google, Quad9, OpenDNS, AdGuard, DNS.WATCH, Digitalcourage and dns0.eu, plus resolvers in the USA, Switzerland, Japan, Canada, China and Russia. In the browser only the six DNS over HTTPS providers are reachable, which the note Abfrage über DNS-over-HTTPS points out. There’s no resolver picker here, since the tool asks all of them anyway.

The Antworten (answers) table shows, per resolver, its location, the answer, the lowest TTL and the response time. The TTL tells you how long a resolver may keep an old answer at most.

Findings

Finding	Meaning and what to do
Alle n Resolver liefern dieselbe Antwort (all n resolvers return the same answer)	The change has arrived everywhere.
Alle n Resolver melden NXDOMAIN (all report NXDOMAIN, warning)	The name doesn’t exist anywhere. A typo or missing delegation.
n verschiedene Antworten (n different answers, warning)	Normal after a change until the old TTL runs out. Below it, a note per answer lists which resolvers return it. If the answers stay different, CDNs or geo-DNS are often behind it, or name servers with diverging data. The name server check helps then.
n Resolver ohne Antwort (n resolvers without answer, note)	Individual failures are usually down to the resolver or a firewall, not the domain.
Kein Resolver hat geantwortet (no resolver answered, error)	Check your network connection. If your network blocks outgoing UDP 53, all direct queries fail.

Name server check

The name server check asks each name server of your zone individually and compares what the parent zone (i.e. the registrar) and the zone itself say about the name servers.

Type the domain into Domain and click Prüfen (check). If you enter a name below a zone, such as www.example.com, the app checks the parent zone and says so in the note … ist keine eigene Zone (is not a zone of its own).

What gets checked

• Delegation: the parent zone’s NS records are fetched directly from its servers and compared with the zone’s own NS records, glue addresses included.
• Per name server and address: does it answer authoritatively (AA flag), which SOA serial does it return, does it answer recursive queries for other domains, is it reachable over TCP, does it support EDNS.
• Overall: number of name servers, matching serials, spread across networks, plausibility of the SOA values.

The Nameserver table shows, per server and address, AA, Serial, Rekursion (recursion), TCP, EDNS and the response time. The SOA table lists primary name server, contact address, serial, refresh, retry, expire and minimum.

Findings

Finding	Meaning and what to do
Delegation und NS-Records der Zone stimmen überein (delegation and zone NS records match)	Registrar and DNS hosting agree.
Delegation weicht von den NS-Records der Zone ab (delegation differs, warning)	The explanation lists which servers appear only at the registrar and which only in the zone. Make both lists the same.
Glue für … weicht ab (glue differs, warning)	The address stored at the registrar doesn’t match the A record. Update the glue at the registrar.
… hat keine Adresse (has no address, error)	A name server without A/AAAA is unreachable. Fix the NS entry or create the address record.
… antwortet nicht (doesn’t answer; error, warning for IPv6)	The server delays every lookup. For IPv6 it may also be your own network.
Lame Delegation (error)	The server is listed but doesn’t answer authoritatively for the zone. Set up the zone there or remove the NS entry.
Offener Resolver (open resolver, warning)	The name server answers recursive queries for other domains and can be abused for DDoS amplification. Turn off recursion on authoritative servers.
… nicht per TCP erreichbar (not reachable over TCP, warning)	DNS over TCP is mandatory (RFC 7766). Large responses, such as with DNSSEC, get lost otherwise. Open TCP 53 in the firewall.
… unterstützt kein EDNS (no EDNS support, warning)	Outdated software; problems with DNSSEC and large responses are likely.
Unterschiedliche SOA-Serials (different SOA serials, warning)	Zone transfers between the servers are stuck or not done yet. Normal right after a change; otherwise check the transfer.
Alle Nameserver haben Serial … (all have serial …)	All servers are in sync.
Nur ein Nameserver (only one name server, error)	At least two are required, ideally in separate networks.
Alle Nameserver im selben /24-Netz (all in the same /24, warning)	One network outage takes down the whole zone. Add a name server in another network.
SOA … ungewöhnlich (SOA value unusual, warning)	Refresh, retry, expire or minimum are outside the recommendation. The explanation gives the recommended range.
SOA Retry ist nicht kleiner als Refresh (retry not smaller than refresh, warning)	Retry should be shorter than refresh.
Primärer Nameserver … steht nicht in den NS-Records (primary not in NS records, note)	Intentional with a hidden primary (hidden master).
SOA ohne gültige Kontaktadresse (no valid contact address, warning)	The RNAME field of the SOA doesn’t form an email address.
Elternzone nicht erreichbar – Delegation ungeprüft (parent zone unreachable, warning)	The parent zone’s servers didn’t answer. Try again later.

In the browser

In the browser the app can’t query the name servers directly. It only checks what the resolver returns and reports this as Eingeschränkte Prüfung (limited check). Delegation, serials, AA flag, recursion and TCP are only checked by the app on a Mac, PC or mobile device.