{{ summaryTitle }} {{ summaryValue }} {{ summaryLine }}

Enter one public delegated domain, such as example.com.
Choose Cloudflare, Google Public DNS, or Quad9 as the observation point.
Only the first usable domain was checked; {{ ignoredExtraLines }} additional lines were was ignored.
Off keeps IPv6 informational; On makes missing AAAA records a review condition.
{{ requireIpv6Enabled ? 'On' : 'Off' }}
Off checks one resolver; On adds a resolver-view ledger and drift signal.
{{ compareResolversEnabled ? 'On' : 'Off' }}
CheckStateEvidenceOperator noteCopy
{{ row.check }}{{ row.state }}{{ row.evidence }}{{ row.note }}
NameserverIPv4IPv6ResponseCopy
{{ row.host }}{{ row.ipv4 }}{{ row.ipv6 }}{{ row.response }}
PriorityActionWhyCopy
{{ row.priority }}{{ row.action }}{{ row.why }}
ResolverNS setResponseCopy
{{ row.resolver }}{{ row.nsSet }}{{ row.response }}
DNS Zone File Generator Draft a BIND or provider-ready DNS zone file with normalized records, SOA and TTL checks, plus mail and DNSSEC review warnings.
Reverse DNS Zone Generator Generate an IPv4 reverse DNS zone with PTR records and SOA validation plus RFC 2317 classless delegation and parent-zone CNAME guidance.
MX Record Lookup Inspect a domain's MX route and compare public DNS answers while catching Null MX conflicts, unresolved exchanges, and alias targets.
DNS Glue & Delegation Check Check DNS glue and delegation for a public zone, compare resolver views, and identify missing NS addresses, aliases, or DS evidence.

A DNS change can look complete from one network while another resolver still sends visitors toward an old or incomplete delegation. Nameserver health is therefore a question of reachability, consistency, and authority, not merely whether an NS record exists.

Delegation
The parent-zone NS records that identify the servers responsible for a child zone.
Glue
Parent-supplied address records that help a resolver reach an in-bailiwick nameserver, such as ns1.example.com serving example.com.
Authoritative answer
A response from a server that holds the zone, rather than a cached answer from a recursive resolver.
SOA
The Start of Authority record, which identifies zone authority and carries the serial and transfer timing fields.

The parent zone delegates a domain by publishing nameserver hostnames. A recursive resolver follows that referral, finds an address for each nameserver, and then asks an authoritative server for records inside the child zone. Healthy public service usually needs more than one independently useful nameserver, address data for every delegated hostname, and an SOA response for the zone apex. IPv6 remains a separate policy decision because IPv4-only authority can work even when dual-stack coverage is required locally.

Resolver disagreement deserves context. Cached NS data can differ during a planned move until relevant time-to-live values expire, while persistent differences may point to a parent-zone mistake or an incomplete provider cutover. A recursive-resolver view is a valuable user-side observation, but direct queries to the parent and each authoritative server provide stronger change-control evidence.

How to Use This Tool:

Start with the delegated zone itself and choose the resolver whose public view you want to inspect.

  1. Enter one public domain such as example.com. If several non-empty lines are pasted, only the first usable domain is checked.
  2. Select Cloudflare, Google Public DNS, or Quad9 as the main resolver. Enable Require IPv6 coverage only when missing AAAA records should become a review condition.
  3. Enable Compare resolvers when propagation or cache differences are plausible. The run then compares the NS set seen by all three built-in resolvers with the selected baseline.
  4. Review the overall state, then inspect the nameserver and repair rows. Retry with another resolver after a transport error, and confirm any consequential finding with direct authoritative queries.

Interpreting Results:

Healthy means the selected recursive view found at least two nameservers, an SOA answer, address data for every nameserver, no requested IPv6 gap, and no resolver mismatch. It does not prove that every authoritative server answers correctly or that parent-side glue is complete.

  • Action identifies missing NS or SOA evidence, or a delegated nameserver with neither A nor AAAA data.
  • Review covers a single-server delegation, required IPv6 gaps, or NS-set disagreement between resolvers.
  • Resolver response codes and transport messages distinguish an empty answer from a request that could not be completed.

Technical Details:

The health result combines a point-in-time recursive DNS lookup with a deterministic classification. NS and SOA records are queried at the normalized domain, then each returned nameserver hostname is checked for A and AAAA records. Optional comparison repeats the NS query through three public recursive resolvers.

Lookup Core

The lookup sequence preserves the difference between delegation evidence, zone evidence, and nameserver address coverage.

Stage Question Evidence used
Delegation view Which nameserver hostnames does the resolver return? NS answers at the checked domain
Zone visibility Is authority data visible at the same name? SOA answer count
Address coverage Can each returned nameserver hostname be mapped to an address? A and AAAA answer counts per nameserver
Resolver agreement Do the other public resolvers return the same sorted NS set? Zero, one, or two views differing from the selected baseline

Rule Core

A more severe rule wins. IPv6 gaps count only when IPv6 coverage is required.

State Exact condition Meaning
Action No NS answer, no SOA answer, or at least one nameserver has zero A and zero AAAA answers The selected resolver cannot show a complete usable path.
Review No Action condition, but fewer than two nameservers, at least one resolver mismatch, or at least one required IPv6 gap The path is visible but has a redundancy, policy, or consistency concern.
Healthy Neither Action nor Review condition applies The sampled recursive view is internally clear.

Names are lowercased, trailing dots are removed, and a URL or email-like input is reduced to its hostname. Public hostnames must contain at least two labels, stay within 253 characters, and use valid DNS label syntax. Each DNS request has a 6.5-second timeout. NS sets are compared without regard to record order or letter case.

Accuracy and Privacy Notes:

DNS results are live network observations, not a local simulation. The checked domain and record types are sent to the selected public resolver over DNS over HTTPS; resolver comparison sends NS queries to all three built-in resolvers. Their caches, filtering, outages, and geographic views can affect the answer.

  • The check does not query the parent zone directly, test UDP or TCP port 53 on each authority, compare SOA serials across authorities, or validate DNSSEC.
  • A visible A or AAAA record does not prove that the address is publicly reachable or serving the intended zone.
  • Use direct non-recursive queries to at least two delegated servers before a high-risk DNS cutover.

Worked Examples:

Provider migration still in cache

Cloudflare returns the new two-server NS set while one other resolver still returns the old set. With comparison enabled, the result is Review. Wait through the relevant TTL, then compare the parent referral and direct authoritative answers before deciding that the migration failed.

Delegated host without address data

The resolver returns two NS hostnames, but one has neither an A nor an AAAA answer. The result is Action because that delegated endpoint has no resolver-visible address path. Check its address records and any required parent-side glue.

References: