Why do two resolvers give different answers for the same domain?

Three common reasons. You changed a record recently and one cache is still serving the old value until its TTL expires. The domain uses geographic or latency-based routing, so the answer depends on where the resolver sits. Or one resolver is applying a filtering policy, which some do for malware domains.

How long does a DNS change take to propagate?

At most the TTL of the record you replaced, counted from the last time each resolver cached it. There is no global propagation delay; there is only cache expiry. Lower the TTL before a planned change and raise it afterwards.

What is the difference between an A record and a CNAME?

An A record holds an address. A CNAME holds another name, and the resolver then looks that up. A CNAME cannot coexist with other records at the same name, which is why it is not allowed at a zone apex. Providers work around this with ALIAS or ANAME records that flatten to an address at query time.

Why does my TXT record look split into two quoted strings?

A single character-string in DNS is capped at 255 bytes, so longer values, notably DKIM keys, are published as several strings in one record. Consumers concatenate them with no separator. The split is a wire format detail and does not change the value.

Does this tool query the authoritative nameserver directly?

No. It queries two public recursive resolvers over DoH, which is what your own devices experience. To see the zone before caching, query the nameservers listed in the NS result directly with dig, using the at-sign syntax.

DNS Lookup

Query A, AAAA, MX, TXT, NS, SOA, CAA and more against Cloudflare and Google at once, with TTLs and the DNSSEC AD flag.

Why two resolvers

A single resolver answer tells you what that resolver has cached, which is not the same as what the zone publishes. Querying Cloudflare at 1.1.1.1 and Google at 8.8.8.8 in parallel and diffing the results catches the two most common real problems: a change that has not expired everywhere, and a geographic routing setup that behaves differently than you expected.

The tool does not treat a TTL difference as a disagreement, because remaining TTL depends on when each cache filled.

Internationalised names

Names with non-ASCII characters are converted to punycode (RFC 3492) before the query, since DNS carries ASCII labels. The result shows both forms so you can confirm the conversion matched the name you intended. Mixed-script names that could be confused with an ASCII name are shown in punycode with a note.

What this tool does not do

It does not perform zone transfers, it does not enumerate subdomains, and it does not brute-force names. Those are reconnaissance functions rather than diagnostics, and the answer to “what subdomains does this company have” is not something a diagnostic tool needs to provide.

About this tool

Enter a hostname and a record type, and we query Cloudflare and Google over DNS-over-HTTPS in parallel and show both answers side by side. Each result carries the record data, the TTL as the resolver returned it, the authoritative section where present, and whether the resolver set the DNSSEC authenticated data flag. Where the two disagree, the tool says so rather than picking a winner.

How to read the result

A and AAAA records: The IPv4 and IPv6 addresses behind the name. Several records mean the operator is load balancing at the DNS layer, and a name with A records but no AAAA is IPv4-only.
TTL: How many seconds the answer may be cached before a resolver has to ask again. A resolver reports the remaining TTL from its own cache rather than the value the zone publishes, so two resolvers showing different TTLs for one record is normal and not a disagreement.
MX records: The mail exchangers for the domain, each with a preference value, where lower preference is tried first and equal values are used round-robin. For a full mail check including SPF, DKIM, and DMARC, use /mx-lookup.
TXT records: Free-form strings attached to the name. In practice they carry SPF policies, DKIM public keys under a selector, the DMARC policy at _dmarc, and domain ownership verification tokens.
NS and SOA: The nameservers the zone is delegated to, and the start of authority record that describes the zone. SOA carries the primary nameserver, the responsible-party email with the at sign written as a dot, the serial, and the negative caching TTL in the final field.
CAA: Names the certificate authorities allowed to issue for the domain. An empty result means any CA may issue, which is the default rather than a misconfiguration.
DNSSEC AD flag: Set by the resolver when it validated the chain of trust up to the root. No AD flag means either the zone is unsigned, which is the majority case, or that validation failed, so it is a statement by the resolver about its own check.
Resolver disagreement warning: Raised when the two resolvers return different record data for the same query. The usual causes are a recent change still working through caches, geographic DNS answering differently per resolver location, and a stale entry in one cache.

Questions people ask

Why do two resolvers give different answers for the same domain?: Three common reasons. You changed a record recently and one cache is still serving the old value until its TTL expires. The domain uses geographic or latency-based routing, so the answer depends on where the resolver sits. Or one resolver is applying a filtering policy, which some do for malware domains.
How long does a DNS change take to propagate?: At most the TTL of the record you replaced, counted from the last time each resolver cached it. There is no global propagation delay; there is only cache expiry. Lower the TTL before a planned change and raise it afterwards.
What is the difference between an A record and a CNAME?: An A record holds an address. A CNAME holds another name, and the resolver then looks that up. A CNAME cannot coexist with other records at the same name, which is why it is not allowed at a zone apex. Providers work around this with ALIAS or ANAME records that flatten to an address at query time.
Why does my TXT record look split into two quoted strings?: A single character-string in DNS is capped at 255 bytes, so longer values, notably DKIM keys, are published as several strings in one record. Consumers concatenate them with no separator. The split is a wire format detail and does not change the value.
Does this tool query the authoritative nameserver directly?: No. It queries two public recursive resolvers over DoH, which is what your own devices experience. To see the zone before caching, query the nameservers listed in the NS result directly with dig, using the at-sign syntax.

Last reviewed 2026-09-05.