Nameserver Checker

Look up a domain's nameservers, then ask every one of them directly whether it actually answers authoritatively - catching lame delegation and out-of-sync zone data a normal lookup can't reveal.

Resolves NS records, then queries each nameserver's own IP address directly over UDP port 53. If your network blocks direct DNS queries, the authoritative checks below will show as unreachable.

Enter a domain to look up its nameservers and verify each one directly.

Not checked

Run a check to see nameserver health.

Nameservers 0 published NS records

Authoritative 0 addresses answered authoritatively

Issues 0 unreachable or non-authoritative

SOA Serials — consistent across nameservers?

🛰️ Direct Authority Checks

Each nameserver's resolved address, queried directly for this domain's SOA record.

Nameserver Address SOA Serial Status Time

🔎 Findings

📇 Nameservers & Glue Records

Hostname IP Addresses

📋 Query Details

Domain

—

Nameservers Found

—

Addresses Checked

—

Distinct SOA Serials

—

Checked At

—

📦 Raw API Result

"Lame delegation" means a nameserver is listed in the domain's NS records but doesn't actually answer authoritatively for it - often left over from a provider migration. A mismatched SOA serial usually just means one nameserver hasn't picked up the latest zone update yet, which typically resolves on its own within the zone's refresh interval.

HOW IT WORKS

Direct Queries, Not Just a Recursive Lookup

Most "nameserver checkers" only show what a recursive resolver reports for a domain's NS records - useful, but it can never reveal whether a listed nameserver actually works. This tool goes one step further: after resolving the NS hostnames and their own glue A/AAAA addresses through a trusted recursive resolver, it opens a direct UDP connection to every resolved address and asks it, by itself, for the domain's SOA record. A server that answers with the authoritative flag set is doing its job; one that answers without it, answers with an error, or doesn't answer at all is flagged as its own finding. Comparing the SOA serial number returned by each nameserver also reveals when one has fallen behind the others after a zone update.

What else can you check?

These tools all work on the same connection and address data — pick whichever question you actually have.

Want to see the full path to a site? DNS, redirects, every hop, the CDN, TLS and the origin server. Want to know your public IP? See your IPv4 and IPv6 addresses, location, ISP and ASN. Want to check your tower & route? Live ping, speed, DNS, traceroute and a map of nearby points. Want to ping from around the world? Real latency from real probes across 12 countries, live on a map. Want to locate any IP address? City, region, country and coordinates for any public IP. Want to know if an IP is risky? Proxy, VPN, Tor, hosting and abuse-report indicators. Want to know if you're blacklisted? Check an address against major spam and abuse DNSBLs. Want to know who owns an IP? Network owner, ASN, CIDR range and abuse contact. Want to explore an AS number? Announced prefixes, BGP neighbours and registry details. Want to test your connection speed? Measure real download, upload, ping and jitter. Want to see what changed? Word-level diff between two blocks of text or code. Want to know if a DNS change is live yet? Compare answers from five independent public resolvers. Want to check a domain's DNSSEC setup? DNSKEY, DS records, signature expiry and real validation. Want to see the hop-by-hop path to a server? A real traceroute from a genuine probe anywhere in the world. Want to know if a server port is open? A real TCP connection attempt - open, closed or filtered. Want to measure latency to a server? Real connect timing - min/avg/max, jitter and connection loss. Want a clean URL slug from a title? Real transliteration, stop words and batch mode. Want to find and replace across a document? Regex, capture groups and a live preview before you commit. Want to find the invisible character? Code points, escapes, bytes and hidden-character detection. Want to escape text for HTML? Minimal, named or numeric entities, attribute-safe. Want to strip emoji cleanly? Whole clusters - no half-flags or stray modifiers left. Want to spot repeated words? Frequency, density and accidental doubles like "the the". Want to know if a URL is cached? Two requests prove whether your CDN is really caching it. Want to see what a site knows about you? Storage, cookies, tokens and what your browser actually cached. Want to run that check on any site? One-click bookmarklet reads storage and tokens where they live. Want to know who your site talks to? Renders the page and names every outside company it contacts.

COMMON QUESTIONS

Nameserver Checker FAQ

What is lame delegation?

It's when a domain's NS records list a nameserver that isn't actually configured to serve that zone - often left behind after switching DNS providers. Resolvers may still work around it by trying other listed nameservers, but it adds risk and latency.

Why does a nameserver show as "unreachable directly"?

Either that specific server is down or firewalled, or the network this checker runs on restricts direct outbound DNS queries to arbitrary third-party servers. If every nameserver shows this, it's almost always the latter - try the DNS Propagation Checker instead, which only needs outbound HTTPS.

Is a serial mismatch a serious problem?

Usually not - it just means one nameserver hasn't refreshed from the primary yet. It should resolve itself within the zone's configured refresh interval. A mismatch that persists for a long time is worth investigating.

Why check glue records at all?

A nameserver hostname is useless without a working IP address behind it. Checking for A/AAAA records confirms the glue is actually in place, not just that a hostname is listed.