Test DNS : check a domain name’s DNS records

A DNS server turns a domain name into information machines can use: IPv4 or IPv6 addresses, mail servers, name servers. It answers questions about a name, a type and a class, in the formats set out in RFC 1035.

A recursive resolver looks the answer up on the client’s behalf, querying servers one after another. An authoritative server publishes the contents of one specific zone and nothing else: its answer carries the AA bit. The first works for the user, the second is the source. Read more.

Thirteen identities, from a to m.root-servers.net, run by twelve organisations. The number comes from the size of the original UDP responses, not from a current technical limit: each identity is anycast from several hundred instances around the world. No DNS mechanism can discover that list: every resolver knows it from a hints file shipped with its software. Read more.

A top-level domain, such as fr, com or org, attached to the root. The root delegates each TLD to a set of servers, which in turn delegate the registered domains. Together they form a tree whose top is the final dot of an absolute name.

The time to live, in seconds, during which a resolver may keep an answer and serve it from its cache. It belongs to the record set of the same name and type, not to the name. A long TTL reduces load, a short TTL makes a change visible sooner. Read more.

DNS does not push changes out: it lets copies expire. Each resolver applies the TTL it received, on its own schedule. The delay you observe is that of the oldest copy still valid, not an official propagation delay. Read more.

The SOA names the primary server and the contact address, and sets the refresh, retry and expire intervals plus the minimum used for negative caching. Its serial number must increase on every change: a secondary server only transfers the zone if it considers the primary’s serial higher than its own. Read more.

NS records point to the servers that are authoritative for a zone; they exist at the parent, which delegates, and at the apex of the child zone. When an NS target belongs to the delegated domain, the parent must also publish its address: that is the glue record, without which the resolver goes round in circles. Read more.

Keeping “this name does not exist” answers. RFC 2308 sets the duration from the SOA minimum, with upper bounds. In practice: a name tested before it was created can stay unfindable for a while, even once it has been published. Read more.

“Valid DNS” means the delegated servers answered and their SOA records agree. “Inconsistencies” flags a difference between servers: different serials, a missing answer, or a non-authoritative one. A domain can resolve for the user while showing an inconsistency, which will surface at the next zone change. Read more.

So that resolution survives a machine’s failure, maintenance or overload. RFC 2182 recommends several servers on separate networks, with a single source of writes. Two neighbouring machines powered and connected by the same infrastructure are not redundancy. Read more.

A server named in the delegation that is not authoritative for the zone: it does not load it, or answers with a referral instead of an authoritative answer. The symptom is resolution that fails intermittently, depending on which server is queried. Read more.

A set of signatures added to responses, letting a resolver verify that the data really comes from the zone it claims and has not been altered. Trust is built from the root down to the zone through DS records. DNSSEC brings no confidentiality. Read more.

The two forms of zone transfer. AXFR carries the whole zone on every synchronisation; IXFR carries only the differences since the serial the secondary already holds. A full transfer remains the fallback when history is no longer available. Read more.

It queries the root servers, then the domain’s TLD servers, then the delegated name servers, and reads the SOA from each. A difference between answers flags an inconsistency: a named server that does not answer, different serials, a partial delegation. The method is described in the guides. Read more.

Each test fires several dozen queries at the root servers, the TLD servers and the domain’s own servers. This per-IP limit stops automated use from turning the tool into a source of load for those servers, and for the service itself.