Direct answer
Compare the same record name and type before and after an approved DNS change, recording the resolver, time and answer. Investigate differing results with the DNS owner; one resolver's answer does not establish the state everywhere.
Capture the baseline
Record the exact name, record type, response and collection time before the change. Document the intended new value and responsible DNS owner. A record at a similar name is not necessarily the same configuration object.
Reference: RFC 1034: Domain names: concepts and facilities.
Account for caching
DNS data may be cached for a period specified by the record's time to live, and resolver behavior and query location can differ. Record the resolver used and consult the owner about expected transition timing instead of assuming a single immediate response represents every client.
Reference: RFC 1034: Domain names: concepts and facilities.
Compare like with like
Repeat the same query from approved locations and compare the name, type and answer. For a mail-routing change, the owner may also need to test delivery through the approved mail flow; a matching DNS response alone does not prove the application works.
- Record any error or missing answer rather than labeling it as a pass.
- Avoid changing unrelated records during verification.
- Keep the change reference and verification time.
Escalate unexpected results
If an answer differs beyond the expected transition, check the authoritative configuration and resolver path with the DNS administrator. Do not claim that a change has failed globally or completed everywhere based on one cache. Record the remaining uncertainty and schedule a follow-up.
Assessment limits
A small set of DNS queries cannot prove worldwide propagation or service availability. Network, resolver, cache and configuration differences affect observations.
Frequently asked questions
Does one correct DNS answer prove every user sees it?
No. Resolvers and caches may differ. Test representative paths and record what was observed.
Does a missing answer prove a domain is unused?
No. The queried type, resolver, time or configuration can affect the result.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.