DNS Delegation Checker – how to verify your domain's DNS delegation

Curiosities, news, inspirations.
DataHouse Tools

DNS Delegation Checker – verify your domain's DNS delegation

Incorrect DNS delegation can make your website unavailable, disrupt email delivery, and affect other services. Learn what to verify and how to quickly identify the most common configuration issues.

Check DNS delegation Learn more

What is DNS delegation?

The Domain Name System is one of the foundations of the Internet. It translates human-readable domain names into IP addresses, so users do not need to remember technical server addresses.

DNS delegation identifies which name servers are authoritative for a domain. These servers receive queries for the records used by the website, email, subdomains, and other services.

In practice: even a correctly configured web server will remain unavailable if the domain delegation points to incorrect or non-responsive DNS servers.

Authoritative DNS servers provide records such as:

A

A and AAAA

They specify the IPv4 and IPv6 addresses of the server hosting a website or another service.

@

MX

They identify the servers responsible for receiving email for the domain.

T

TXT

They store data used by SPF, DKIM, DMARC, and verification systems.

C

CNAME

They create an alias that points one domain name to another host.

Why is correct DNS delegation so important?

DNS delegation is the first step in directing a user to a website or service. If an error occurs at this stage, the rest of the infrastructure may be configured correctly and the domain can still fail.

Incorrect delegation can cause:

  • complete or intermittent website downtime,
  • problems sending and receiving email,
  • different DNS answers depending on which server is queried,
  • domain verification failures in external services,
  • incorrect operation of subdomains and applications,
  • issues after enabling or changing DNSSEC.

Some errors do not affect every user at the same time. A domain may work on one network and fail on another. This is why DNS issues can be difficult to diagnose without checking the responses from all authoritative servers.

What does the DNS Delegation Checker verify?

The DataHouse tool analyzes the key elements of domain delegation and helps identify inconsistencies that may affect service availability.

NS records

NS records wskazują serwery nazw odpowiedzialne za obsługę domeny. Narzędzie pozwala sprawdzić, czy lista serwerów jest poprawna oraz czy serwery odpowiadają zgodnie z oczekiwaniami.

The analysis can help detect:

  • a name server that does not respond,
  • differences between delegation and zone configuration,
  • outdated or incorrect NS records,
  • inconsistent responses from individual servers.

SOA record

The SOA, or Start of Authority, record contains the main administrative information about a DNS zone. One of its most important elements is the serial number.

If the servers return different SOA serial numbers, some of them may be using an outdated version of the zone.

SOA element Meaning
Serial The version number of the DNS zone configuration.
Refresh The interval after which a secondary server checks for a new zone version.
Retry The waiting time before retrying a failed zone transfer.
Expire The period after which zone data may be considered invalid.
Minimum TTL The value associated with caching negative DNS responses.

DNSSEC

DNSSEC cryptographically confirms the authenticity of DNS responses. It improves security, but an incorrect configuration can cause otherwise valid records to be rejected by validating resolvers.

During the analysis, pay attention to:

  • DS records published in the parent zone,
  • DNSKEY records in the domain zone,
  • RRSIG signatures,
  • the consistency of the entire chain of trust.
Important After removing or changing DNSSEC keys, you must also update the DS record with the domain registrar. Leaving an outdated record in place may make the domain unavailable.

Authoritative server consistency

A domain usually uses at least two name servers. This improves reliability, but only when all servers publish the same up-to-date data.

If one server has an older version of the zone, users may receive different answers depending on which server handles the query.

What are glue records?

Glue records are required when a name server is located within the domain it serves.

For example, the domain example.pl may use ns1.example.pl as a name server. Before a resolver can query that server, it must know its IP address. This information is supplied by a glue record stored at the registry or registrar level.

Missing or outdated glue records can cause lookup loops, resolution errors, and complete domain unavailability.

When should you run a DNS delegation test?

Delegation should be checked not only during an outage. Any significant change to the domain or infrastructure is a good reason to run a test.

  • after changing the DNS provider or name servers,
  • after transferring the domain,
  • after migrating the website or email service,
  • after enabling, changing, or disabling DNSSEC,
  • after modifying the zone configuration,
  • before launching a new production environment,
  • when the website works only for some users,
  • when email messages are not delivered correctly.

DNS delegation and propagation

After DNS records are changed, previous answers may remain in resolver caches for some time. This period depends mainly on the TTL value.

Propagation does not explain every issue. If authoritative servers return different data or some of them do not respond, waiting alone will not fix the configuration.

The DNS Delegation Checker helps distinguish normal cache delay from a genuine delegation, DNSSEC, or server synchronization problem.

The most common DNS delegation problems

The issues most commonly found during diagnostics include:

  • an inconsistent NS record list,
  • no response from one of the servers,
  • different SOA serial numbers,
  • incorrect glue records,
  • missing or outdated DS records,
  • DNSSEC signature errors,
  • different zone versions on authoritative servers,
  • delegation still pointing to the previous provider's servers.

Detecting these issues early can shorten outages and reduce the risk of website, email, and domain-dependent system downtime.

Who is the DNS Delegation Checker for?

The tool is designed for system administrators, DevOps specialists, hosting companies, infrastructure operators, developers, and domain owners.

It does not require software installation or knowledge of diagnostic commands. Simply enter a domain name to begin analyzing its DNS delegation.

Check your domain's DNS delegation.

Verify NS records, SOA data, DNSSEC, and authoritative server consistency. Detect potential issues before they affect your services.

Run the DNS Delegation Checker