Verify a nameserver migration
Confirm the parent delegation and the zone's own NS records list the same servers before the old provider is switched off.
Authoritative zone health
Ask the nameservers
themselves.
Read the delegation from the parent zone, then query each nameserver over TCP for NS, SOA, DNSKEY and a zone transfer.
Domain not found
Check the spelling and try again.
Tracing target
Resolving public DNS
Reading address, mail, nameserver and policy records.
Try
Your connection
Detecting…
Checking IPv4
Locating network
Checking provider
What the result means
Delegation checked at the source, not through a cache
A recursive resolver hides which nameserver answered. DNSTrace.dev reads the delegation from the parent zone's own servers, then queries every delegated nameserver directly over TCP port 53 and compares what each one serves: the authoritative flag, NS set, SOA serial and timers, signatures, the DS-to-DNSKEY chain and whether zone transfers are open to anyone.
- Parent and zone NS agreement
- Lame, unreachable and drifting servers
- Glue, DNSSEC chain and AXFR policy
Diagnostic field guide
Use the evidence, not the guess.
Three practical ways to use this lookup, followed by the boundary the result cannot cross.
Reviewed Sep 2026Find the server behind intermittent failures
A lame or unreachable nameserver only breaks lookups for the resolvers that happen to pick it. This test asks each one directly.
Audit DNSSEC and transfers
Check that the DS record at the parent matches a published key and that zone transfers are refused to the public.
How to read the result
- Enter the registrable domain, not a hostname inside it; delegation exists at the zone cut.
- Read the nameserver table first: an unreachable or non-authoritative server explains most resolver-dependent failures.
- Fix the NS mismatch before anything else, then re-run once the parent's TTL has expired.
Common questions
Before you act on the result
What is a lame delegation?
The parent lists a nameserver for the zone, but that server does not answer authoritatively for it. Resolvers that choose it receive REFUSED or a non-authoritative answer and must retry another server.
Why do the parent and zone NS records differ?
The delegation at the registrar was changed without updating the zone, or the zone was updated without changing the registrar. Both lists should be identical so every resolver converges on the same servers.
Why is the SOA serial different on one server?
That secondary has not received the latest zone, usually because notifications or transfers from the primary are failing. It keeps serving stale data until its expire timer runs out.
Choose the question
One system, sixteen focused tools.
Each tool has its own indexable page and runs only the checks its question needs, with the full report one click away.
DNSDNS lookup
Every address, mail, verification and policy record.
A · AAAA · MX · TXT · NS GLBGlobal DNSLive answers from probes across ten countries.
Answer · TTL · resolver · latency ZONEDNS health checkEvery nameserver asked directly for delegation, serial, glue and DNSSEC faults.
Authoritative · TCP 53 · AXFR RDPWHOIS / RDAPRegistrar, dates, status and published contacts.
Registry + registrar data IPIP lookupNetwork owner, route, reverse name and region.
IPv4 + IPv6 ASNASN lookupAutonomous system, BGP prefix and RPKI state.
RIPEstat routing signals NETGlobal network testPing, traceroute, MTR and HTTPS timing from ten countries.
Latency · loss · route · edge TLSSSL checkerIssuer, validity, names and fingerprint.
Live certificate check MXMX lookupReceiving servers, preference and detected mail provider.
Mail routing records MAILEmail securityComplete validation across authentication and transport.
Seven policy controls SPFSPF checkerSender policy, authorization strength and DNS-limit risks.
Policy syntax + safety DMARCDMARC checkerEnforcement, alignment, rollout and report destinations.
Anti-spoofing policy DKIMDKIM checkerSelector lookup, key presence, type and base64 form.
Public signing keys STSMTA-STS checkerDNS marker plus live HTTPS transport policy.
Encrypted inbound mail RPTTLS-RPT checkerSMTP TLS report policy and destination validation.
Transport visibility HDRSecurity headersBrowser protections from the final HTTPS response.
HSTS · CSP · framing · policyEvidence before certainty
The internet has layers.
We keep them separate.
A nameserver identifies the DNS operator. An edge address identifies a public delivery network. An ASN identifies the organization announcing a route. None automatically proves where a hidden origin application runs.
ObservedCorrelatedUnknown stays unknown
Read the detection methodology →
Field notes
Read the signal correctly.
DNS · 6 minDNS propagation is really cache expiry
Why locations disagree, what TTL controls and when to test again.
REGISTRY · 5 minWHOIS text became structured RDAPWhere registration fields come from and why some remain unpublished.
DELIVERY · 7 minAn edge address is not an originWhat public CDN and hosting signals can and cannot prove.
Agent-ready JSON
Give your script or your AI the same public evidence.
GET /api/dns?target=example.com&type=MX
Complete lookup for
example.com
Just resolved
Scoped check
See the full report
Only this section ran.
Target
example.com
Resolves to
93.184.216.34
Announced by
Edgecast
Network location
United States
Delivery platform detected
Cloudflare is in front of this domain
These public addresses terminate at the provider's edge.
Primary IP
Not available
IPv4 address
ASNrouted
Not available
Autonomous system
NameserversNS
Not available
No NS records found
Observed status
Reachable
DNS is answering normally
IPv6
Public address
Network address
- Announced by
- Not available
- Route
- Not available
- Reverse name
- Not available
- Network region
- Not available
Every published answer
DNS records
| Type | Host | Answer | TTL |
|---|
No records in this group.
Showing 0 records
Certificate history + live DNS
Subdomains
Discovering names from certificate transparency, then checking which ones still resolve.
| Host | Live DNS chain | State | Certificate evidence |
|---|
Subdomain data unavailable
Certificate Transparency could not be reached.
Showing 0 hosts
Certificate transparency is historical evidence. “Not resolved” means the name did not return a current A/CNAME answer; it may be retired, internal, or IPv6-only.
Live answers around the world
Global DNS
Queries run on real probes in ten countries. Results may vary because of propagation, geo-routing, or resolver cache.
Worldwide resolver checkReady to probe
Not run
10
real probe locations
Run a check to see what each resolver returns.
See propagation, not a simulation.
Each row will show the probe city, network, recursive resolver, answer, TTL, and query time.
Authoritative nameservers, asked directly
Zone health
Reads the delegation from the parent zone, then queries every nameserver over TCP port 53 for NS, SOA, DNSKEY and a zone transfer. No recursive resolver sits in between.
Grade–
Health scoreWaiting for a runDelegation, reachability, authority, serial agreement, glue, DNSSEC and transfer policy.
Parent zone–Delegation is read from the parent's own servers
| Nameserver | Queried address | Response | Authoritative | SOA serial | Signed | AXFR |
|---|
See what resolvers actually reach.
Each check names the nameserver at fault and what to change.
What answers on HTTPS
Web delivery
Correlated public signalsDetected stack
Confidence rises when DNS, HTTP and network evidence agree
Browser protectionsSecurity headers
Read from the final HTTPS response
Delivery and anti-spoofing
Email security
MX
Mail providerNot detectedNo MX records returned
Grade–
Policy scoreWaiting for a domainChecks distinguish valid policy from record presence.
Action items–Failures and hardening recommendations
SPFChecking sender policy
DMARCChecking anti-spoofing policy
DKIMChecking common selectors
MTA-STSChecking transport policy
TLS reportingChecking aggregate reports
BIMIChecking brand indicator
Where traffic lands
Network & hosting
AS
Announced by (BGP)Not available
- Registered to (RDAP)
- Not available
- Registry assignee
- Not available
- ASN
- Not available
- Range
- Not available
- Connection
- Not available
- Timezone
- Not available
- BGP prefix
- Not available
- RPKI route
- Not available
- Reverse DNS
- Not available
- Routing model
- Not available
- Abuse contact
- Not available
Approximate network location
Not available
IP geolocation, not a device address
Reachability from ten countries
Global network
Real probes ping, trace the route to, or fetch the target. Latency reflects the probe's network, and anycast targets answer from a different edge in each region.
Measure, don't guess.
Each card shows the probe location, its network, and the round-trip, route or HTTPS timing it observed.
Registry data
Registration
Signals worth noticing
Security posture
SSL / TLS certificate issued by
Checking certificate…
Reading certificate transparency records
Checking
Not available
Not available
Not available
Authoritative DNSChecking nameservers
Mail policyChecking SPF and DMARC
Certificate policyChecking CAA records
Allocation authority
IP registry
Registry allocation ≠ device owner
These records describe the organization responsible for the address range. They do not identify the individual using this IP.
Routing and operational checks
IP route signals
RPKI validationChecking route authorization
BGP announcementChecking the public routing table
Reverse DNSChecking PTR ownership signal
Abuse contactFinding the responsible network desk
Network roleClassifying the announcing network
Location precisionApproximate network region only