DNS Trace Analyzer & Delegation Tool

Perform an authoritative, step-by-step DNS delegation trace from the root servers down to your zone. Diagnose lame delegations, NS record mismatches, glue record anomalies, and authoritative server latency with surgical precision.

No signup

Instant results

100% free

What Is DNS Delegation Tracing?

DNS delegation tracing follows the complete iterative resolution path from root servers through TLD nameservers to your authoritative nameservers. It exposes every referral hop, DS record, and glue record in the delegation chain — making broken delegations immediately visible.

Why DNS Delegation Tracing is Critical

DNS delegation failures — lame delegations, missing DS records, broken DNSSEC chains, or parent-child NS mismatches — are invisible to standard lookups but cause intermittent or complete resolution failures that are extremely hard to diagnose without a full trace.

Common DNS Delegation Errors

Lame delegations returning SERVFAIL, stale parent NS records after migration, missing or expired DS records breaking DNSSEC, and glue record mismatches are the most common delegation errors exposed by a DNS trace.

CLIENT_QUERY

ROOT_RESPONSE

TLD_DELEGATION

AUTH_ANSWER

TRACE_ENGINE_V2

FULL_PATH_TRACED

How It Works

Root Server Query

The trace begins by querying one of the 13 logical root server clusters to retrieve the authoritative TLD nameservers for the queried domain.

TLD Referral

The root server responds with a referral to the TLD nameservers. These servers hold the NS delegation and DS records for your domain.

Authoritative Delegation

Queries the TLD nameservers to retrieve your domain's delegated NS records, glue addresses, and DNSSEC DS records.

Final Resolution

The authoritative nameservers are queried directly for the requested record type, validating the end-to-end resolution chain.

Step-by-Step Iterative Tracing

Bypasses caching resolvers and performs a raw iterative trace from root to authoritative, showing every referral hop and response flag in the delegation chain.

Lame Delegation Detection

Automatically flags nameservers that return non-authoritative responses or SERVFAIL, indicating misconfigured or abandoned zone delegations.

Parent/Child NS Consistency

Compares the NS records served by the parent TLD with the NS records in your own zone file, detecting mismatches that cause resolver confusion.

Glue Record Validation

Inspects the Additional section of referral responses to verify that in-bailiwick glue A/AAAA records are present, correct, and match authoritative data.

DNSSEC Chain of Trust

Analyzes DS records at the parent zone and DNSKEY records at the child zone to validate the complete DNSSEC chain of trust from root to your domain.

Latency & RTT Profiling

Measures the Round-Trip Time for each iterative query hop, identifying slow or geographically distant nameservers that degrade DNS resolution performance.

Frequently Asked Questions

What is a DNS delegation trace?

A DNS delegation trace is the process of resolving a domain name by iteratively querying the DNS hierarchy, starting from the root (.) servers, down to the TLD servers, and finally the authoritative nameservers, exactly how a recursive resolver operates natively.

How does a delegation trace differ from a standard dig or nslookup?

Standard queries usually ask a local caching resolver (like 8.8.8.8) to do the work, which can mask underlying configuration errors due to cached records. A trace forces a fresh, un-cached, step-by-step resolution path.

What is a lame delegation in DNS?

A lame delegation happens when the parent zone points to a nameserver (via NS records) that is either offline, non-existent, or not configured to answer authoritatively for the child zone, leading to degraded performance or complete outages.

Why do I need glue records?

Glue records are A or AAAA records provided by the parent zone for nameservers that are subdomains of the zone being delegated (in-bailiwick). They are necessary to break the circular dependency where a resolver must know the nameserver's IP to query it, but must query the nameserver to find its IP.

What does an NS record mismatch mean?

It means the nameservers listed at your domain registrar (parent zone) do not perfectly match the nameservers defined in your actual DNS zone file (child zone). This violates RFC 1034 and can cause resolvers to cache incorrect delegation paths.

Can a DNS trace diagnose DNSSEC failures?

Yes. A trace reveals the exact point where DS records are passed from the parent zone and whether they match the DNSKEY records at the child zone, helping you isolate broken chains of trust that cause SERVFAILs.

Why is my DNS trace showing high latency at the root or TLD level?

High latency usually indicates suboptimal Anycast routing by the root or TLD operators from your testing location, or packet loss over UDP port 53. While you cannot control root/TLD latency, analyzing authoritative server RTT can help you optimize your own DNS hosting geography.