Propagation

CNAME Record Propagation — How Long It Takes

CNAME record changes propagate in minutes to 4 hours. Email provider CNAMEs for DKIM alignment take the same time — here's how to verify they're live.

CNAME for DKIM (SendGrid, M365, etc.)

Providers give you a host under your zone pointing at their rotating key. Your job is to publish the CNAME and wait for caches to agree.

TTL strategy

Lower TTL before you switch providers or selectors so the new target visible faster.

Chains

Some targets are themselves CNAMEs. All labels in the chain must resolve — if any hop is stale, DKIM can fail intermittently.

Check CNAME propagation

Open Propagation checker →

Also read: CNAME setup guide · SendGrid DMARC fix

Step by step

Step 1 Add the CNAME on the exact host your provider lists (never at apex).

Step 2 Wait at least one TTL cycle before assuming failure.

Step 3 Select CNAME in Propagation and query the full hostname.

Step 4 Ensure the last hop in any chain matches the provider's current target.

Step 5 Send test mail and confirm DKIM passes once DNS converges.

FAQ

How long does CNAME propagation take?

Typically minutes to four hours on major resolvers — same class as A/TXT unless NS delegation is involved.

Do DKIM CNAMEs take longer?

No special delay — they're normal CNAME RRs. The DKIM selector host must resolve everywhere receivers query.

How does TTL impact CNAME checks?

Each resolver caches the CNAME answer for the TTL you set. Lower TTL before cutovers.

How do I verify a CNAME is live?

Propagation checker with type CNAME on the full subdomain until all five resolvers show the expected target.

Can CNAME chains add delay?

Extra hops mean more lookups, but propagation is still about cache expiry per label — watch TTL on each step.

← All DNS record guides

Open DomainPreflight →