Domain DNS Validation
Validate a domain's DNS delegation in one report: check that its authoritative name servers agree, are reachable, and are wired up correctly.
About Domain DNS Validation
Domain DNS Validation looks past what a single resolver returns and audits the health of a zone's delegation itself. It starts by reading the domain's NS records, then contacts each listed authoritative name server directly and asks whether it actually serves the zone. The result is a coherence report: a clear pass or fail, the full list of declared name servers, and a table showing, for every server, its IP address, whether it answered authoritatively, and the SOA serial it is currently serving.
The central idea is that all of a domain's authoritative servers should tell the same story. If one server serves an older SOA serial than the others, a zone transfer has fallen behind and stale data is being handed out. If the set of NS records differs between servers, the delegation is inconsistent. If a name server listed in the delegation has no A record, its glue may be missing, and if a server does not answer authoritatively at all, it is effectively dead weight in the delegation. Each of these conditions is surfaced as a plain-language issue so you know precisely what to fix.
This validation matters because DNS resolution only needs one working name server to appear fine day to day, which masks problems that surface at the worst possible moment, during an outage of your primary provider or a slow zone propagation. Catching a lagging secondary, a single point of failure, or a missing glue record before it bites is far cheaper than debugging intermittent resolution failures later. The checks focus on the structural correctness of the delegation rather than the content of individual records.
It complements the propagation checker rather than duplicating it. Where propagation shows you how resolvers around the world currently see a record, validation asks whether the authoritative source of truth is internally consistent and properly delegated. Running it after any name-server change, provider migration, or DNSSEC rollout confirms the new setup is coherent before the rest of the internet starts relying on it. Everything runs server-side from our EU infrastructure.
How to use it
- 1Enter the domain you want to validate, such as example.eu (use the registrable domain, not a subdomain).
- 2Select Validate to fetch the domain's NS set and query each authoritative name server directly.
- 3Read the top badge for the overall verdict: zone coherent, or issues found.
- 4Review the issues list for specific problems such as differing SOA serials, an inconsistent NS set, a server that did not answer authoritatively, or a name server missing its A record.
- 5Use the per-server table to see which name server is the odd one out by comparing IPs, authoritative status and SOA serials side by side.
Common use cases
- -Confirming a name-server or DNS-provider migration is fully consistent before you consider the cutover complete.
- -Detecting a secondary name server whose zone transfer has fallen behind, shown by a mismatched SOA serial.
- -Spotting a missing glue record when a name server in the delegation has no resolvable A record.
- -Verifying redundancy by confirming a domain has more than one reachable, authoritative name server rather than a single point of failure.
- -Auditing client or acquired domains to catch delegation misconfigurations before they cause intermittent outages.
Frequently asked questions
- What does DNS validation actually check?
- It checks that a domain's delegation is coherent: that every authoritative name server listed in the NS records is reachable, answers authoritatively, serves the same SOA serial, and agrees on the NS set. It also flags name servers that are missing an A record, a sign of a missing glue record.
- What is an SOA serial and why compare it across servers?
- The SOA serial is a version number for a DNS zone that increases every time the zone changes. All authoritative servers for a domain should serve the same serial; if a secondary shows a lower number, its copy of the zone is out of date and a zone transfer has failed or lagged.
- What are glue records and why do they matter?
- Glue records are A/AAAA records for a domain's name servers published in the parent zone, needed when the name servers live inside the domain they serve. Without glue, resolution can hit a chicken-and-egg loop. This tool flags a likely missing glue record when a listed name server has no resolvable address.
- How is this different from a plain DNS lookup?
- A DNS lookup shows you the records a resolver returns. Domain DNS Validation goes to each authoritative name server directly and compares them against each other, so it detects delegation problems, such as servers disagreeing or a secondary being out of sync, that a normal lookup would never reveal.
- Why does my domain resolve fine but still show issues?
- Resolution only needs one healthy name server to succeed, so a domain can work day to day while a secondary is lagging or unreachable. Validation exposes those hidden weaknesses so they do not surface during a provider outage when your redundancy is supposed to take over.
- Should I validate the apex domain or a subdomain?
- Validate the registrable domain, for example example.eu rather than www.example.eu, because delegation and SOA records live at the zone apex. This gives you the true picture of how the zone is delegated and synchronised.