THE FIELD NOTES / DNS

Two resolvers. Two perspectives.

Different DNS answers do not automatically mean something is broken.

Caches move on different clocks

A recursive resolver may already have a cached answer. Another may have just fetched a newer answer from the authoritative nameservers. TTL controls how long an answer can be reused, but each cache has its own remaining lifetime.

Answers can be intentionally different

Round-robin records, geographically influenced DNS and traffic management can produce different addresses. This comparison queries Cloudflare and Google from our server. It is not a worldwide propagation test, and it does not measure your device's DNS latency.

What the comparison actually compares

We compare DNS status and answer records. Record ordering and TTL differences are ignored. TXT content stays case-sensitive. Truncated responses and failed lookups produce an incomplete result rather than a claim that the resolvers agree.

Read status before chasing a record

NOERROR with no answer may mean the name exists without that record type. NXDOMAIN means the name does not exist according to that resolver. SERVFAIL is a resolver failure, which can have several causes.

DNSSEC is a separate signal

An authenticated-data flag indicates validation by the resolver. If the flag is absent, the answer may simply be unsigned. Absence alone does not prove a DNSSEC failure.

API references: Google Public DNS · Cloudflare DNS.