How long does DNS propagation take for email records?
Why new MX, SPF, DKIM and DMARC records seem slow to appear, what TTL really does, how to check records yourself, and when to stop waiting.
You added the records. Your provider says they aren't there. You refresh. Still nothing. Is it broken, or are you just early?
Usually you're just early. But "wait 48 hours" is bad advice because most of the time you don't need to wait nearly that long, and sometimes waiting isn't the problem at all. Mostly it is caching, and you can check that yourself.
"Propagation" is really caching
DNS doesn't broadcast a change across the internet. There's no wave spreading outward. When you edit a record, the change is made at your DNS provider immediately. What takes time is that other servers around the world have saved copies of the old answer, and keep using it until the saved copy expires.
That expiry is the TTL, time to live, in seconds. A TTL of 3600 means "you may keep this answer for an hour". After that the resolver asks again and gets the new value.
So the real question isn't "how long to propagate", but "how long might someone have the old answer saved?" The answer is at most the TTL of the old record.
Typical times
| What you changed | Usually visible |
|---|---|
| A brand-new record that never existed | Within minutes |
| Editing an existing record | Up to the old TTL, often 5 minutes to 1 hour |
| Records with a long TTL (a day) | Up to a day |
| Changing nameservers | Often an hour or two, can take up to 48 hours |
New records are fastest, because resolvers have nothing cached. There's one catch: resolvers also cache "this doesn't exist" answers for a while. If a tool looked up your DKIM record before you published it, it may keep reporting "not found" for a few minutes.
How to check without waiting blindly
You can look at what the world sees with two commands. On macOS or Linux:
dig MX yourdomain.com +short
dig TXT yourdomain.com +short
dig TXT _dmarc.yourdomain.com +short
dig TXT selector._domainkey.yourdomain.com +shortOn Windows:
nslookup -type=MX yourdomain.com
nslookup -type=TXT _dmarc.yourdomain.comReplace selector with the DKIM selector your provider gave you. If you want to ask a specific public resolver instead of your own, add @8.8.8.8 to dig (dig @8.8.8.8 MX yourdomain.com) or put the server at the end in nslookup. Comparing answers from two resolvers shows whether the problem is local caching.
Online DNS lookup tools do the same from servers elsewhere. When Mailions verifies your domain, it checks live public DNS, so a record that's visible in a public lookup should pass.
If it still isn't there
After an hour for a new record, caching is no longer a likely explanation. Check these, in order:
- Are you editing the right DNS? Records only count at the provider your nameservers point to. If your domain uses Cloudflare's nameservers, adding records at the registrar does nothing. Adding DNS records at any registrar explains how to find out.
- Is the Name field right? Some screens append your domain automatically.
_dmarc.yourdomain.comtyped in full might become_dmarc.yourdomain.com.yourdomain.com. - Is the value exact? One missing character in a DKIM key invalidates it.
- Is it the right type? MX, TXT and CNAME are not interchangeable.
- Is a proxy hiding it? On Cloudflare, mail-related records must not be proxied.
Make changes without downtime
If you're replacing records on a live domain, plan ahead:
- A day or two before the change, lower the TTL to 300 seconds on the records you'll change. Resolvers will then only hold the old answer for five minutes.
- Make the change.
- Once everything works, raise the TTL again.
For a mail move, publish the new MX records and remove the old ones in the same step. Two sets side by side split your mail between providers.
What to do while waiting
Don't change the record again out of impatience. Each edit starts a new cache clock, and you can end up chasing your own tail. Instead:
- Check the live answer with the commands above.
- Check the nameservers with
dig NS yourdomain.com +short. - Wait until the old TTL has passed before declaring failure.
Once the records are visible, send a test message and look at the authentication results as described in how to check SPF, DKIM and DMARC.
Need the records themselves?
When you add a domain in Mailions, the panel lists every record with its exact Name and Value and checks them for you. If you're on Cloudflare, there's a step-by-step guide. To get access, contact us.
Frequently asked questions
How long do MX record changes take to work?
Usually minutes to a few hours. Resolvers that cached the old record keep it until its TTL expires, so the worst case is roughly the old TTL, often one hour and occasionally a day or two.
How can I check whether my DNS records have propagated?
Query the domain's authoritative nameservers with dig or nslookup to confirm the record is published, then check public resolvers such as 1.1.1.1 and 8.8.8.8. Online tools that query many locations show where an old value is still cached.
Can I speed up DNS propagation?
Not after the change, but you can prepare: lower the record's TTL a day before you change it, make the change, then raise the TTL again. Flushing your own computer's DNS cache only changes what you see.