Why Two DNS Resolvers Give You Different Answers

You change a DNS record, then check it from three places and get two or three different answers. The instinct is to assume something is broken. Usually nothing is — you are watching caches expire at different times. But the same symptom can also hide a genuine fault, and the way to tell them apart is the record's TTL.

The fastest way to see the disagreement clearly is to ask several resolvers the same question at once with the multi-resolver compare tool, rather than guessing from one machine.

Every record carries a TTL — a number of seconds a resolver is allowed to cache the answer. When you publish a new value, a resolver that cached the old one keeps serving it until that timer runs out. Different resolvers cached the record at different moments, so they expire at different moments. For a window no longer than the old TTL, they legitimately disagree.

This is why “propagation” is a slightly misleading word: nothing is slowly spreading across the internet. Authoritative nameservers update instantly. What you are waiting on is old cached copies aging out.

Large public resolvers run anycast: the “1.1.1.1” you reach is a nearby node, not a single server. Two nodes of the same provider can hold slightly different cache states. Providers also honor TTLs and minimum-cache rules differently. And some answers are genuinely location-aware — CDNs return different IPs by region — so two resolvers in different places can both be correct and still differ.

Before a query ever reaches a public resolver, it passes through your operating system's cache and whatever resolver your network hands you — a home router, a corporate server, a VPN. Any of those can hold an older answer than a fresh public lookup. When your laptop disagrees with an online tool, your local path is usually the reason, not the authoritative DNS.

Stop blaming propagation and start investigating once any of these is true:

• The disagreement persists well past the old TTL — caches should all have expired by then.
• Your authoritative nameservers return different records from each other — a sign of an inconsistent or half-finished change.
• Some resolvers return SERVFAIL while others answer — classic DNSSEC validation failure, where validating resolvers reject a broken chain. See NXDOMAIN vs SERVFAIL to decode it.