| # | Zone | Nameservers / IP |
|---|---|---|
| {{ idx + 1 }} | {{ s.zone || 'root (.)' }} | {{ s.ns }} |
The Domain Name System (DNS) resolves human-friendly domain names to machine-readable IP addresses through a delegated hierarchy of authoritative nameservers. Each query may cascade across the root zone, top-level domain (TLD), and successive sub-domains before returning an answer. Understanding this hop-by-hop delegation reveals latency causes, misconfigurations, or malicious tampering along the resolution path.
DNS Trace Analyzer automates that exploration by querying each zone’s NS record via DNS-over-HTTPS, following referrals until it collects the target’s authoritative addresses and any final A records. The tool converts raw answers into a structured hop list and colourful JSON so you can inspect delegation order and verify which server actually replied.
Network engineers, educators, and incident responders can quickly expose stale glue records, cyclic references, or hijacked nodes without opening command-line utilities. By visualising each hop, the tool clarifies whether delays occur at the root, registry, or authoritative layers. Because queries travel over encrypted HTTPS, corporate firewalls may still intercept or rate-limit them; run repeated traces judiciously in restricted environments.
The DNS trace process relies on iterative resolution, where each nameserver returns authoritative referrals instead of direct answers. Starting from the root (.), the resolver submits successive NS queries, dropping the left-most label at every step until the fully-qualified domain is reached. Because every delegation represents a contractual trust boundary, auditing these links reveals performance hotspots and security gaps across registries, operators, and global internet infrastructure.
NS records and receive referrals for the appropriate TLD.NS records of the second-level domain.A (or AAAA) record from an authoritative server.| Hop Class | Meaning |
|---|---|
| Root | Global starting point for every DNS query, denoted by “.” |
| TLD | Top-level domain zone such as .com or .org |
| Second-level | Registered domain (e.g. example.com) |
| Sub-domain | Delegated zone below the registered domain |
| Resource | Authoritative server holding requested address records |
Each hop delays the response by one additional packet round-trip; excessive or out-of-order hops usually signal configuration drift or registrar issues.
NS for delegation, A/AAAA for final mapping.Input: example.com
Iterative trace:
1. . → a.root-servers.net 2. com. → a.gtld-servers.net 3. example.com. → ns-a.example.com 4. A record query → 93.184.216.34
Based on standards in RFC 1034, RFC 1035, and DNSSEC formalised in RFC 4033-4035, plus operational insights from ICANN root-server reports.
Queries include the target domain and travel to the chosen DNS-over-HTTPS provider; no user data is stored by the tool itself.
Follow these steps to map a domain’s entire DNS path.
example.com.A hop is one delegation step where a nameserver refers the resolver to the next authoritative zone.
The root zone is the DNS hierarchy’s starting point; it has no name other than the dot.
No. The tool performs stateless lookups and discards results when you close the page.
Yes. The resolver requests AAAA records automatically when present.
That zone returned no NS answers, indicating misconfiguration or unreachable servers.
.net.