Read DNS differences with context
Two recursive resolvers are two observations—not a worldwide verdict on your DNS.
Start with the response status
NOERROR is a completed query without a DNS error, but it may contain no records of the requested type. NXDOMAIN means a name does not exist according to that resolver; an alias target can also be the missing name. SERVFAIL means the resolver could not complete the query. It is not equivalent to an empty successful answer.
Compare records, not countdowns
IPDNS compares normalized answer records as sets, ignoring order and TTL. It normalizes address notation and domain-name fields while preserving case-sensitive text. Different DNS presentation formats can still appear different. Status differences are also reported. A truncated or failed response is not given a definitive match judgment.
Remaining TTLs depend on when each resolver cached an answer. Our server may reuse successful answers for up to 30 seconds, limited by the lowest answer TTL. We keep the original fetch time and observed TTL rather than presenting them as a fresh measurement.
DNSSEC is a signal with context
“DNSSEC authenticated: Yes” reports the resolver’s AD flag. “No” is not proof of broken signatures: unsigned domains can legitimately produce it. Validation remains enabled in these queries. This tool does not perform an independent chain-of-trust audit.
Where the query comes from matters
Both queries originate from our server, not from your computer’s configured DNS. Google is asked not to forward a client subnet to authoritative servers. We do not supply your visitor IP to either resolver. CDN steering, resolver caches and routing can legitimately produce different answers. There is no global propagation percentage or pass/fail badge here.
A useful next check
- Confirm the exact hostname and record type you changed.
- Read the answer owner names; an alias may lead somewhere else.
- Compare the intended authoritative records and their TTLs.
- If the records look correct, investigate the web, mail or application layer separately.
Sources: Cloudflare DNS JSON, Google DNS JSON, DNSSEC authenticated data, DNS resource records.