DNS Checker

A DNS health check examines multiple aspects of a domain's DNS configuration for errors and best practices. This includes verifying that NS records are correctly configured and reachable, that the SOA record is valid, that MX records point to valid hostnames (not IP addresses), that there are no CNAME records at the zone apex, that TTL values are sensible, that all nameservers return consistent answers, and that DNSSEC is correctly configured if enabled.

Inconsistent answers across nameservers usually indicate a zone transfer failure — secondary nameservers have not received the latest zone data from the primary. This can happen if the SOA serial number was not incremented after a change (so secondaries don't know to fetch updates), if there are network issues blocking zone transfers (AXFR/IXFR on port 53), or if a secondary nameserver is misconfigured. All nameservers in an NS record set should return identical answers for any given record.

A lame delegation occurs when a domain's NS records point to nameservers that either do not exist, are not reachable, or are not authoritative for the domain. This means the nameservers listed in the parent zone are unable to answer queries for the domain, causing resolution failures. Lame delegations often happen when a domain is moved to a new DNS provider but the old nameservers are still listed in the parent TLD zone, or when nameservers are decommissioned without updating DNS.

DNS changes become active on the authoritative nameserver immediately after saving. However, the old records may be cached by resolvers worldwide for the duration of the previous TTL. If the old TTL was 3600 seconds (1 hour), resolvers may serve the old value for up to one hour. To minimise this window, reduce TTL to 300 seconds (5 minutes) at least one TTL period before making a change. After the change is confirmed, restore TTL to a normal value.