DNS Check

It audits the complete DNS delegation: checks that parent and child nameservers agree on NS records, verifies glue records, tests each nameserver for reachability and authority, compares SOA serial numbers across all nameservers, and checks for open recursion. These catch misconfigurations that cause intermittent or complete DNS failures.

When a domain's nameservers are within the same domain (e.g. ns1.example.com for example.com), the parent zone must include an A record for the nameserver alongside the NS record — this is the glue. Without it, there's a circular dependency: you'd need to resolve ns1.example.com to find example.com's nameserver, which requires knowing ns1.example.com first.

NS records exist in two places: the parent zone stores delegation NS records, and the child zone stores authoritative NS records. They must be identical. A mismatch — usually from adding or removing a nameserver without updating both sides — causes unpredictable resolution from different resolvers around the world.

An open recursive resolver answers DNS queries from any source on the internet. Authoritative nameservers should never be open resolvers — they should only answer for zones they're authoritative for. Open resolvers are abused in DNS amplification DDoS attacks where small queries generate large responses sent to a spoofed victim's IP address.

The SOA serial increments with every zone change and is used by secondary nameservers to detect updates. Differing serials indicate incomplete zone propagation — a secondary hasn't received the latest zone transfer. This is usually temporary (seconds to minutes) but a persistent mismatch suggests a broken AXFR/IXFR transfer or misconfigured notify setup.