Inputs
Example
example.com -> parent referral NS set and glue, then SOA and NS straight from each name server address, compared side by side.
llms.txt Validator
Compare the parent delegation with direct authoritative answers: NS sets, required glue, SOA serials and the DS-to-DNSKEY link.
Use it after registrar or DNS-provider changes, and when some resolvers fail while others answer.
Following a domain from its parent to its name servers
Every domain is reachable only through a chain of delegations: the parent zone lists the name servers in NS records and, when those servers live inside the domain, adds glue addresses so resolvers can reach them. When parent and servers disagree, when glue is missing or stale, or when a listed server no longer serves the zone, resolution fails for some resolvers and works for others — the most confusing kind of outage.
This check asks the parent's own servers for the referral and then queries every delegated name server address directly, without recursion, for the zone's SOA and NS records. It compares the parent and child NS sets, checks required glue, reads the authoritative bit and response code of each server, compares SOA serials, and verifies that the DS records at the parent match a DNSKEY at the child.
Checking a delegation step by step
Run it after a registrar change or a DNS-provider migration, or when some users cannot resolve the domain. Read the authoritative table first: every address should answer with AA set and the same serial. A server that answers REFUSED or without the authoritative bit is delegated but does not serve the zone; a timeout means it did not answer at all.
Then compare the NS sets: names listed only at the parent receive traffic they may not serve, and names listed only at the child are never used by resolvers starting at the parent. In-domain name servers need glue in the referral. If DS records are published, at least one must match a DNSKEY, otherwise validating resolvers reject the zone.
Authoritative evidence, bounded on purpose
The direct queries run from the hosting environment of this site, so they test reachability from there; a server can be blocked for some networks and not others. The tool queries a fixed maximum number of servers within a fixed time budget, never asks authoritative servers for recursion, and queries only public addresses obtained from DNS. Discovery of the zone cut uses DNS-over-HTTPS and is labelled separately; if the host cannot send direct DNS queries, the result says so instead of blaming any server. DNSSEC coverage is the DS-to-DNSKEY link, not RRSIG signatures.
Frequently asked questions
What is glue and when is it required?
Glue is an address record the parent publishes for a name server inside the delegated domain, such as ns1.example.com for example.com. Without it a resolver would need the domain to find the server for the domain. Name servers outside the domain need no glue.
Why do parent and child NS records differ?
They are maintained in two places — the parent through the registrar, the child in your zone — and drift apart after migrations. RFC 1034 expects both sets to be the same; resolvers start from the parent's set and often switch to the child's once they reach it.
What does not authoritative mean?
The server answered, but without the authoritative bit for this zone: it is listed in the delegation but not configured to serve it. This used to be called a lame delegation; the tool names the exact behaviour instead.
Why do SOA serials differ between servers?
Secondary servers copy the zone from the primary at intervals. A short difference right after a change is normal; a lasting one means a secondary is not receiving updates and serves stale data.
Why does the tool say the check is unavailable?
When even a root server does not answer direct UDP or TCP queries from this site's host, outbound DNS is blocked there. The tool then reports that it cannot test, rather than reporting your servers as down.
Does a matching DS record mean DNSSEC is valid?
It means the parent points to a key the child publishes — the link that most often breaks during key rollovers. Signature validity and the chain above the parent are not checked here; the DNSSEC Validator and a validating resolver cover those.