Ukraine DNS Propagation Checker
Run a DNS lookup against 4 resolvers located in Ukraine — Ivano-Frankivsk · Irpin · Uman · Khmelnytskyi.
- Resolved
- No answer
- Checking
-
Ivano-Frankivsk
Ukraine
—
-
Irpin
Ukraine
—
-
Uman
Ukraine
—
-
Khmelnytskyi
Ukraine
—
What checking DNS from Ukraine tells you
A DNS resolver keeps a cached copy of each record for as long as its time-to-live allows, and does so separately in every location. A change you have published can be live on one resolver while another still serves the old answer.
Checking from Ukraine looks up the record on servers inside the country, so you see what people there actually get rather than what a resolver on another continent returns.
This matters most right after you edit a record: an update visible on a global resolver like 8.8.8.8 can still be stale at a local ISP in Ukraine until its cached copy expires. The check confirms the new value has reached the resolvers your Ukraine visitors depend on.
Since a 2017 presidential sanctions decree, Ukrainian ISPs have been required to block a list of Russian platforms — VKontakte, Odnoklassniki, Mail.ru and Yandex among them — and much of that enforcement happens at the resolver their subscribers get by default. The bans were renewed and widened after 2022, so the block is a standing feature of Ukrainian DNS rather than a one-off.
Layered on top is the state Protective DNS system, running since early 2023 through the National Security and Defense Council's cybersecurity center. More than 300 providers feed it, and a query for a known financial-phishing domain returns a warning page instead of the real record. A lookup on a Kyivstar or Ukrtelecom line can reflect both policies at once.
So checking a record from inside Ukraine shows what the resolvers most people use return, not always what Google or Cloudflare hand back. It is the quickest way to confirm a new record has reached Kyivstar, Ukrtelecom and Vodafone, and to see whether a sanctions block or Protective DNS entry is affecting your domain.
- Kyivstar Mobile market leader; default resolver on most phones
- Ukrtelecom Fixed-line incumbent, formerly state-owned; nationwide DSL and fibre
- Vodafone Ukraine Second mobile network; hands out its own default resolver
- Cloudflare 1.1.1.11.1.1.1 Common opt-out to reach state-blocked Russian sites
Answers from Ukrainian ISP resolvers are shaped by state policy: sanctioned Russian domains are blocked and known phishing domains are redirected by the national Protective DNS system, so results can differ from an unfiltered resolver.
How DNS propagation works
Every DNS record carries a time-to-live: the seconds a resolver may keep its cached answer before asking again. Change a record and resolvers holding the old value keep serving it until that timer runs out.
Propagation is this expiry playing out across many independent resolvers, so a lower time-to-live set ahead of a change makes it take effect sooner. There is no fixed waiting period — each record's time-to-live decides how long the old answer lingers.
Frequently Asked Questions
Why do DNS servers in Ukraine return different results than 8.8.8.8?
Two things cause it. Each resolver caches independently, so one can hold an older answer than another.
And content delivery networks reply based on where the asking resolver is, steering a resolver in Ukraine toward a nearby edge node.
Both answers can be correct at the same time for their own location.
How long until a DNS change is visible in Ukraine?
It depends on the record's time-to-live, not on the country.
Resolvers in Ukraine keep the previous answer until their cached copy expires, then pick up the new one.
If you lowered the time-to-live before making the change, it appears sooner; otherwise the old value can persist until the original timer elapses.
Which DNS server should users in Ukraine use?
For most people the resolver their internet provider assigns is fine and usually the lowest latency.
Anyone who wants an alternative can point to a public resolver reachable from Ukraine, such as Cloudflare (1.1.1.1) or Google (8.8.8.8); the right choice depends on whether you value speed, privacy, or filtering.
Why check DNS from Ukraine specifically?
Because it shows what visitors in Ukraine actually resolve, which can differ from a global lookup.
If your audience is in Ukraine, or you have moved hosting or mail there, checking against in-country resolvers confirms the records have reached the servers those users rely on.
Why do some Russian sites fail to resolve from Ukrainian ISPs?
A 2017 presidential decree, renewed and extended since, orders ISPs to block sanctioned Russian services including VKontakte, Odnoklassniki, Mail.ru and Yandex. Much of that enforcement sits at the provider's default resolver, so the record simply does not come back on a normal Kyivstar or Ukrtelecom connection. Because a large part of the block is DNS-based, users who switch to a public resolver like 1.1.1.1 or 8.8.8.8, or use a VPN, often still reach the sites.
What is Ukraine's Protective DNS and does it change lookups?
It is a national anti-phishing filter run through the National Security and Defense Council's cybersecurity center, live since early 2023, with more than 300 providers connected. When a subscriber requests a domain flagged for financial phishing, the resolver returns a warning page instead of the real address. It only touches domains on that phishing list, so ordinary records resolve normally, but it is one reason a lookup from a participating Ukrainian ISP can differ from an unfiltered one.
