Nameserver health check

What this tool checks

A domain's DNS works only if its nameservers do. The tool walks down from the root servers to the parent zone (such as .com) and reads the delegation: the NS records and glue addresses the registry hands out for your domain. No public resolver is involved.

It then asks every IPv4 address of every nameserver directly, without recursion, for:

• the zone's SOA record, to see whether the server is authoritative and which version (serial) of the zone it holds;
• the zone's NS records, to compare the zone's own list with the parent's;
• the A and MX records at the zone apex, to spot servers with different data;
• the SOA again over TCP, without EDNS, and with EDNS version 1, to test protocol support (RFC 7766, RFC 6891);
• a name from someone else's zone with recursion requested, to find servers that act as open resolvers.

It also resolves each nameserver name, compares the addresses with the glue, checks that each nameserver's own domain still exists, and looks up the network (AS) of each address.

What it can't see:

• IPv6. Our server has IPv4 only, so IPv6 addresses of nameservers are listed but not tested.
• Other vantage points. Times are measured from our server in the UK.
• Zone contents. It compares a few apex records, not the whole zone.
• DNSSEC. Use the DNSSEC check for signatures and DS records.

Reading the results

Nameservers lists every name from either list, where it is listed, its glue and its addresses.

Each server, asked directly has one row per address:

If you enter a name that is not a zone of its own, such as www.example.com, the tool checks the zone it belongs to.

Common problems and fixes

A lame or unreachable nameserver

A server that does not answer, or answers without authority, is usually left over from a move between DNS hosts. Resolvers time out on it, so lookups get slower. Remove it from the NS records at your registrar and in the zone, or add the zone back to it.

The parent and the zone list different nameservers

The registry's list (set at your registrar) is the one resolvers follow first. Make both lists identical:

example.com.  3600  IN  NS  ns1.example.net.
example.com.  3600  IN  NS  ns2.example.net.

Different SOA serials

Right after an edit, secondaries can lag for a few minutes. If it lasts, zone transfers are failing: check allow-transfer and also-notify on the primary and that TCP port 53 is open between the servers. With two DNS providers, each numbering its own copy is normal, and the tool says so instead of warning.

Missing or stale glue

A nameserver inside its own zone (ns1.example.com for example.com) can only be found through glue at the parent. Register the host and its address at your registrar ("child nameservers" or "host records") and update it when the address changes.

A nameserver whose domain is not registered

If a nameserver's own domain has expired, anyone can register it, run that nameserver and answer for your zone. Remove the server from your NS records straight away.

Open recursion

An authoritative server should only answer for its own zones. Open recursion invites amplification attacks and cache poisoning. In BIND:

options {
    recursion no;
};

No TCP

Large answers and DNSSEC need TCP. Allow TCP port 53 through the firewall.

FAQ