DNS Lookup — Every Record, Mail Authentication and Propagation

Time to live, in seconds — how long a resolver may cache the record before asking again. A 3600 TTL means a change can take up to an hour to be seen everywhere. Lower the TTL a day before a planned migration, then raise it afterwards.

Either the change has not aged past the old TTL, or it was added to a zone that is not authoritative. Check the NS records first — if they point at a different provider than the one you edited, that is where your change needs to go. The resolver comparison shows which caches have caught up.

Nothing propagates. Each resolver independently caches an answer until its TTL expires and then asks again, so during a change some resolvers hold the old answer and some the new one. That is why four resolvers are queried here — disagreement between them is exactly what "still propagating" looks like.

SPF ending in -all rather than ~all, and DMARC at p=quarantine or p=reject rather than p=none. Those two clauses are behind most deliverability problems, and both are graded on this page with the reason attached rather than printed as raw text.

It reports whether answers came back authenticated, meaning the zone is signed and a resolver can detect tampering in transit. An unsigned zone is common and not a fault, but nothing cryptographically prevents a forged answer being accepted.

AdGuard filters ad and tracker domains by policy, so it will refuse to resolve some names the others answer normally. That is a blocking decision rather than a propagation problem, which is why it is shown but excluded from the agreement test.