DNS Consistency Checker

Analyze and validate DNS records across multiple authoritative nameservers for propagation synchronization, serial number mismatches, and zone consistency. Ensure RFC 1034/1035 compliance and prevent sporadic resolution failures caused by desynchronized SOA or NS records.

No signup

Instant results

100% free

What Is DNS Consistency Checker?

Why It Matters

DNS consistency is critical when operating redundant authoritative nameservers. If a primary server updates a zone but secondary servers fail to synchronize (due to AXFR/IXFR failures or network partitions), resolvers will receive conflicting records depending on which nameserver they query. This leads to intermittent connectivity issues, unpredictable application behavior, and potential email delivery failures if MX or TXT (SPF, DKIM, DMARC) records are out of sync. Regular consistency checking detects serial number discrepancies and mismatched record sets across your entire delegation chain before they cause user-facing outages.

Common DNS Consistency Issues

Failing to increment the Start of Authority (SOA) serial number after making zone changes prevents secondary nameservers from initiating zone transfers, leaving them serving stale records.

NS_PRIMARY

SOA_SERIAL

NS_SECONDARY

AXFR_SYNC

CONSISTENCY_ENGINE

ZONE_MATCH

How It Works

Nameserver Discovery

The checker queries the parent TLD to identify all delegated authoritative nameservers for the target domain.

Parallel SOA Queries

Issues concurrent SOA record queries directly to each identified authoritative nameserver to extract their respective serial numbers.

Record Set Validation

Queries critical record types (A, AAAA, MX, TXT, NS) across all nameservers to detect any divergence in the returned resource records.

Discrepancy Analysis

Aggregates the responses, compares TTLs and record values, and flags any inconsistencies that indicate synchronization failures or misconfigurations.

SOA Serial Synchronization Check

Validates that all authoritative nameservers report the exact same SOA serial number, ensuring successful zone propagation.

Parent-Child NS Alignment

Compares parent zone delegations against child zone NS records to detect lame delegations and optimize resolution paths.

Multi-Record Type Validation

Simultaneously checks consistency for A, AAAA, CNAME, MX, TXT, and SRV records across all authoritative nodes.

TTL Consistency Auditing

Detects mismatched Time-To-Live (TTL) values across nameservers that could lead to unpredictable caching behavior at recursive resolvers.

IPv4 and IPv6 Dual-Stack Support

Fully supports querying nameservers over both IPv4 and IPv6 transports to ensure consistent routing across modern network stacks.

DNSSEC Status Verification

Checks for the consistent presence and validity of RRSIG and DNSKEY records across all servers to maintain trust chains.

Frequently Asked Questions

What is DNS consistency?

DNS consistency means that every authoritative nameserver for a given domain returns the exact same resource records and SOA serial numbers for a specific query. This ensures that regardless of which nameserver a recursive resolver contacts, the client receives the correct, up-to-date IP address or policy record.

Why do SOA serial numbers mismatch?

SOA serial mismatches typically occur due to failed zone transfers (AXFR/IXFR) between primary and secondary nameservers. This can be caused by firewall blocks on port 53 (TCP), incorrect TSIG keys, or configuration errors where the primary server's serial wasn't incremented after an update.

How long does DNS propagation take?

DNS propagation depends on the TTL (Time-To-Live) of the previous records. While global recursive resolvers may cache records for the duration of the TTL (often up to 24-48 hours), authoritative nameservers should synchronize almost immediately depending on the refresh interval in the SOA record and notify mechanisms.

What is a lame delegation?

A lame delegation occurs when a parent zone (like the .com TLD) delegates authority to a nameserver (via NS records), but that nameserver is not actually configured to answer authoritatively for the domain. This leads to query timeouts and DNS resolution errors.

Why is DNS consistency important for email security?

Email security relies heavily on TXT records for SPF, DKIM, and DMARC, as well as MX records. If these records are inconsistent across your nameservers, receiving mail servers might query a stale nameserver, fail to validate your domain's policies, and incorrectly route legitimate emails to spam.

Can TTL mismatches cause issues?

Yes. If different authoritative nameservers serve the same records but with different TTLs, recursive resolvers will cache the responses for varying durations. This creates unpredictable behaviors during migrations or incident responses where you need precise control over record expiration.

How often should I check DNS consistency?

It's highly recommended to check DNS consistency immediately after making any changes to your DNS zones, during infrastructure migrations, and as part of regular automated health checks to catch silent synchronization failures before they impact end-users.

Guru Guides

NS Drift

Unexpected nameserver movement is a high-signal indicator for risk.

Dangling CNAMEs

Understand how stale CNAMEs lead to subdomain takeover risk.

DNS Hijacking

Learn how registrar changes can redirect traffic silently.

Related Security Tools

Ensure Flawless DNS Propagation Today

Don't let silent synchronization failures disrupt your services. Run a comprehensive DNS consistency audit across all your authoritative nameservers instantly.

Start Free Trial View Pricing