DNS Health Check & Validation Tool

Perform a comprehensive, RFC-compliant deep inspection of your domain's DNS zone. Identify subtle misconfigurations, propagation anomalies, and security vulnerabilities across SOA, NS, MX, TXT, and A/AAAA records before they cause service degradation.

No signup

Instant results

100% free

What Is a DNS Health Check?

A DNS Health Check is a comprehensive, RFC-compliant audit of your domain's entire DNS zone. It validates nameserver redundancy, SOA timer accuracy, DNSSEC chain integrity, MX record structure, and IPv6 readiness — catching subtle misconfigurations before they cause deliverability failures or service outages.

Why DNS Health Matters

DNS is the foundation of all internet services. A single misconfigured SOA TTL, lame delegation, or missing glue record can cause intermittent resolution failures, email delivery drops, and website downtime.

Common DNS Architectural Flaws

Lame delegations, NS records on different subnets, missing AAAA glue for IPv6, stale SOA serials, and absent DNSSEC signatures are the most common causes of DNS health check failures.

NS_AUTHORITY

DELEGATION_OK

SOA_SERIAL

SYNC_MATCH

HEALTH_PROBE_V1

ZONE_HEALTHY

How It Works

Zone Delegation Traversal

Queries root servers down to the TLD to verify the complete delegation chain and identify lame or broken NS referrals.

Nameserver Sync Audit

Polls all authoritative nameservers to compare SOA serial numbers and detect zone transfer failures or stale secondaries.

RFC Compliance Check

Validates individual record syntax, SOA timer values (Refresh, Retry, Expire), and MX priority weighting against RFC standards.

Performance & Reachability

Measures UDP/TCP query latency to each nameserver, checks IPv6 AAAA glue, and validates DNSSEC chain of trust.

Delegation Consistency Verification

Cross-references NS records served by the parent TLD against those returned by your authoritative nameservers, detecting parent-child delegation mismatches that cause resolution failures.

SOA Timer Analysis

Evaluates Start of Authority (SOA) parameters including Refresh, Retry, Expire, and Minimum TTL against RFC 1912 recommendations to prevent stale caches and slave synchronization failures.

DNSSEC Trust Chain Validation

Traces the cryptographic chain of trust from the root zone DS record through your zone's DNSKEY and RRSIG records, identifying broken or missing signatures that disable DNSSEC protection.

IPv6 (AAAA) Readiness

Validates dual-stack compatibility by verifying all authoritative nameservers have reachable AAAA records and glue, ensuring your zone resolves correctly over IPv6-only networks.

Mail Routing (MX/TXT) Integrity

Analyzes MX record priority structures and associated reverse DNS (PTR) alignment to ensure mail routing is correctly configured and consistent across all nameservers.

Anycast & Geo-Routing Detection

Identifies latency discrepancies and routing anomalies across geographically distributed nameservers, highlighting potential anycast misconfiguration or regional resolution failures.

Frequently Asked Questions

What is a 'Lame Delegation' and how does it impact DNS resolution?

A lame delegation occurs when a parent zone (like the .com TLD) delegates a domain to a set of nameservers, but one or more of those nameservers are not configured to answer authoritatively for the zone. This results in intermittent DNS lookup timeouts, increased latency as resolvers retry failed servers, and ultimately degraded availability for end users.

Why do SOA serial numbers need to match across all nameservers?

The SOA (Start of Authority) serial number dictates the version of your DNS zone. Secondary nameservers use this integer to determine if they need to initiate a zone transfer (AXFR/IXFR) from the primary. Desynchronized serials indicate failing zone transfers, meaning some resolvers will receive stale cache data (e.g., old IP addresses) depending on which nameserver they query.

How does DNSSEC prevent cache poisoning attacks?

DNSSEC (RFC 4033) adds cryptographic signatures (RRSIG) to DNS records. When a recursive resolver queries a DNSSEC-enabled domain, it verifies these signatures against public keys (DNSKEY) published in the zone, chained via DS records to the parent TLD. This ensures the response was not spoofed in transit (Kaminsky attack) and guarantees data origin authentication.

What are the recommended values for SOA Refresh and Expire timers?

Per RFC 1912 and modern best practices, typical SOA values include a Refresh time of 1-12 hours (3600-43200 seconds), Retry of 15-120 minutes (900-7200 seconds), and Expire of 2-4 weeks (1209600-2419200 seconds). The Minimum TTL (Negative Cache TTL) should generally be set to 1 hour (3600 seconds) to balance query load with rapid recovery from configuration errors.

What is EDNS0 and why is it critical for modern DNS?

EDNS0 (Extension Mechanisms for DNS, RFC 6891) expands the traditional 512-byte UDP payload limit for DNS queries. It is mandatory for transferring large responses like DNSSEC signatures or expansive TXT records. If firewalls or routers improperly fragment or drop large UDP packets (MTU blackholing), EDNS0 fails, breaking DNSSEC and complex queries.

How do missing glue records cause unresolvable domains?

Glue records are A/AAAA records provided by the parent TLD for nameservers that are subdomains of the domain they serve (e.g., ns1.example.com for example.com). Without glue, a resolver attempting to find the IP for ns1.example.com must query example.com, which it cannot do without the IP for ns1.example.com—creating an infinite unresolvable loop.

Why is TCP fallback essential for authoritative nameservers?

While DNS primarily uses UDP port 53 for efficiency, TCP port 53 must be open and functional. When a DNS response exceeds the EDNS0 UDP payload size (or if UDP is restricted), the server sets the Truncated (TC) bit. The client must then retry the query over TCP (RFC 7766). Blocking TCP 53 breaks zone transfers and large response resolution.

Guru Guides

DNSSEC Posture

Learn how DNSSEC adds authenticity to DNS answers.

NS Drift

Why unexpected nameserver movement is a high-signal indicator for risk.

DNS Hijacking

Learn how registrar changes can redirect traffic silently.

Related Security Tools

Audit Your DNS Architecture

Execute a full-stack cryptographic and syntactical audit of your domain's namespace. Identify single points of failure before they manifest into critical outages.

Start Free Trial View Pricing