DNS Check
Audit a domain's delegation: parent/child Name Server (NS) agreement, glue, per-nameserver reachability and authority, Start of Authority (SOA) serial convergence, and open recursion.
Monitor this automatically
NetTests can run this check on a schedule, preserve historical results, compare changes over time, and alert you the moment something breaks.
Start monitoring free → See all monitoring productsFrequently Asked Questions
What does DNS Check audit?
It audits the complete Domain Name System (DNS) delegation: checks that parent and child nameservers agree on Name Server (NS) records, verifies glue records, tests each nameserver for reachability and authority, compares Start of Authority (SOA) serial numbers across all nameservers, and checks for open recursion. These catch misconfigurations that cause intermittent or complete DNS failures.
What is a glue record?
When a domain's nameservers are within the same domain (e.g. ns1.example.com for example.com), the parent zone must include an A record for the nameserver alongside the Name Server (NS) record — this is the glue. Without it, there's a circular dependency: you'd need to resolve ns1.example.com to find example.com's nameserver, which requires knowing ns1.example.com first.
What does 'parent/child NS mismatch' mean?
Name Server (NS) records exist in two places: the parent zone stores delegation NS records, and the child zone stores authoritative NS records. They must be identical. A mismatch — usually from adding or removing a nameserver without updating both sides — causes unpredictable resolution from different resolvers around the world.
What is an open recursive resolver and why is it a problem?
An open recursive resolver answers Domain Name System (DNS) queries from any source on the internet. Authoritative nameservers should never be open resolvers — they should only answer for zones they're authoritative for. Open resolvers are abused in Distributed Denial-of-Service (DDoS) amplification attacks where small queries generate large responses sent to a spoofed victim's Internet Protocol (IP) address.
Why do SOA serial numbers differ across nameservers?
The Start of Authority (SOA) serial increments with every zone change and is used by secondary nameservers to detect updates. Differing serials indicate incomplete zone propagation — a secondary hasn't received the latest zone transfer. This is usually temporary (seconds to minutes) but a persistent mismatch suggests a broken Full Zone Transfer (AXFR)/Incremental Zone Transfer (IXFR) transfer or misconfigured notify setup.