Nameserver Checker

Server assisted New DNS & Domains

Find the zone's nameservers, then query each of their addresses over TCP port 53 with recursion disabled and compare the answers, AA flags and SOA serials. Zones hosted on Cloudflare DNS cannot be checked: the queries come from a Cloudflare Worker, which may not open TCP connections to Cloudflare's own addresses.

Privacy: The name you look up is sent from the Mutqan server to the public DNS resolvers named in the results. Nothing is stored.

What is an authoritative nameserver?

An authoritative nameserver holds the zone itself and answers for it with the AA (Authoritative Answer) flag, instead of passing on a cached copy like a resolver. A zone is delegated to a set of them through NS records in the parent zone, and all of them should serve the same data and SOA serial; one that is listed but does not answer authoritatively is a lame delegation.

How to use Nameserver Checker

  1. Enter the domain (or any name inside it); the tool finds the zone and its nameservers itself.
  2. Keep SOA to compare serials, or pick A, AAAA, MX, NS or TXT to check that a specific record set is identical on every nameserver.
  3. Press Check nameservers and read the verdict: "nameservers agree" needs every address to answer the same, authoritatively.
  4. Use the table to find the address that differs, times out or answers without the AA flag, and fix that server or remove it from the delegation.

Nameserver Checker features

  • Finds the zone that holds the name and its NS set, then asks every nameserver address directly — IPv4 and IPv6
  • Recursion-disabled queries over TCP port 53, so each answer is the server's own copy of the zone, not a cache
  • Per address: response code, Authoritative Answer (AA) flag, SOA serial, the records returned with the TTL the server serves, and the reply time
  • Verdict across the whole NS set: agree, disagree, or not verified when some addresses could not be asked
  • Lame delegation, refused queries, lagging secondaries (different SOA serials) and per-host IPv4/IPv6 mismatches called out
  • Six query types: SOA (default), A, AAAA, MX, NS and TXT
  • States plainly when a zone is hosted on Cloudflare DNS and therefore cannot be checked from a Cloudflare Worker

Inputs and outputs

Inputs

  • Domain name — a zone apex such as example.com or any name inside a zone; a reverse zone works by its in-addr.arpa or ip6.arpa name.
  • Record type — SOA (default, for serials), A, AAAA, MX, NS or TXT.

Outputs

  • Summary — the zone, how many addresses answered out of all addresses in the NS set, the number of distinct answers with the verdict, the SOA serials seen and how many addresses were not queried.
  • Nameserver answers — one row per address: nameserver, IP, response code, AA flag, SOA serial, the records, their TTL as that server serves it, reply time and a note (not queried, timeout, not authoritative).
  • Findings — which servers disagree, lag or refuse, the majority answer when more than half of the answering addresses share one, and why some addresses were not asked.
  • How this was measured — the server's notes on TCP queries, the edge vantage point and limits that applied.

Nameserver Checker example

SOA of wikipedia.org on its three nameservers

Input:

wikipedia.org · type SOA

Output:

Zone: wikipedia.org · Addresses that answered: 6/6 · Distinct answers: 1 — nameservers agree · SOA serials: 2026060420
ns0.wikimedia.org  208.80.154.238    NOERROR  AA ✓  2026060420
ns0.wikimedia.org  2620:0:861:53::1  NOERROR  AA ✓  2026060420
… ns1 and ns2 the same on IPv4 and IPv6
Findings: Every answering server serves serial 2026060420 (2026-06-04 #20). All 6 addresses of the NS set answered, agree and are authoritative.

How to read the Nameserver Checker results

"nameservers agree": every address of the NS set answered authoritatively with the same records and serial — the record set you queried is consistent across the NS set. Other record types are not covered by this run.

"nameservers disagree": at least one address returned different data, a different serial, an error code or no AA flag. A higher serial on some servers usually means the others have not transferred the latest zone yet; check again in a few minutes.

"agreement not verified": nothing contradicts, but not every address answered or could be asked (for example some are on Cloudflare's network), so agreement across the whole set is not claimed.

REFUSED or an answer without AA marks a lame server; a timeout on one address only often points to a firewall that drops TCP/53 or to a server that is down.

When to use Nameserver Checker

  • Before and after moving DNS hosting: confirm that the new nameservers answer authoritatively and serve the same SOA serial, or the same records of the type you select.
  • After editing a record: check that every nameserver serves it before waiting for resolvers to pick it up.
  • Auditing secondary DNS: spot a secondary whose SOA serial stays behind the primary.
  • Finding lame delegations left behind by a former DNS provider in the NS set.

Troubleshooting

  • "Every nameserver of this zone is on the Cloudflare network": the zone is hosted on Cloudflare DNS, which a Cloudflare Worker cannot query over TCP. Use DNS Lookup or DNS Propagation Checker, or query the nameservers from your own machine with dig +norecurse.
  • A nameserver marked "name has no address": the NS record points to a host without A/AAAA records — fix the glue or the host's address records. "address lookup timed out" or "address lookup failed" says nothing about the host: the resolver did not answer for it, so run the check again before changing anything.
  • Only some addresses time out: the server may block TCP/53 or be down on that address family (IPv4 or IPv6). Authoritative servers must answer over TCP.
  • The check is refused because a nameserver resolves to a private address: the delegation points at an internal host, which this public check never connects to.

Frequently asked questions about Nameserver Checker

Why can a domain on Cloudflare DNS not be checked?

The checker runs as a Cloudflare Worker, and Workers may not open raw TCP connections to Cloudflare's own IP ranges. When every nameserver of the zone is on Cloudflare the check stops with that explanation; when only some are, those addresses are listed as not queried. DNS Lookup and DNS Propagation Checker still work for such zones.

What does a different SOA serial mean?

Each change to a zone should raise its serial, and secondary servers copy the zone when they see a higher serial. Two serials at once means a secondary has not caught up yet (normal for a few minutes after a change) or that the providers publish the zone independently.

What is a lame delegation?

A nameserver listed in the delegation that does not answer authoritatively for the zone: it refuses the query or replies without the AA flag. Resolvers that pick it get errors or stale data, so remove it from the NS set or configure the zone on it.

Why does the tool use TCP instead of UDP?

A Worker can only open TCP sockets, and every authoritative server must answer over TCP (RFC 7766). The query is sent with recursion disabled, so each server answers from its own copy of the zone, not from a cache.

How many nameservers are checked?

Up to eight nameservers in alphabetical order, with at most two addresses each (one IPv4 and one IPv6 when both exist), four seconds per address and about 24 seconds for the whole check.

Technical notes

The NS set comes from a public resolver over DoH; when the name is not a zone apex, the zone is taken from the SOA record in the authority section. Each nameserver name is resolved, every address must be public, and one wire-format query (RFC 1035) with the RD bit cleared is sent over TCP (RFC 7766) — up to 8 nameservers × 2 addresses, 4 s each, four at a time, about 24 s per check.

An answer counts as authoritative only with the AA flag set (RFC 9499 defines the terms). Serial differences follow the SOA serial convention that secondaries transfer the zone after a NOTIFY or refresh when the primary's serial is higher (RFC 1996, RFC 1912 §2.2). Addresses inside Cloudflare's published ranges are never connected to, because the platform refuses those sockets.

Limitations and methodology

Zones hosted on Cloudflare DNS cannot be checked: the queries come from a Cloudflare Worker, and the platform refuses TCP connections to Cloudflare's own address ranges. For mixed setups, the Cloudflare addresses are listed as not queried.

At most 8 nameservers (alphabetical) and 2 addresses each are asked; anycast nameservers answer from the site nearest the Cloudflare edge running the check, which may differ from what other regions reach.

One query type per run, and the check stops at about 24 seconds; addresses left when time runs out are reported as not queried rather than guessed.

Security and privacy

The name and type you enter are sent from the Mutqan server to a public resolver (to find the nameservers) and then directly to each of the zone's nameservers over TCP port 53. Nothing is stored.

References