Global DNS Explorer

How it works

Queries each authoritative name server of a domain directly and compares the answers with Google and Cloudflare DNS-over-HTTPS and the local resolver. Shows SOA serial drift (propagation in progress), DNSSEC validation, lame delegation, CNAME at the apex, glue hints, TTLs, and what changed since the previous check.

• Finds the zone (walking up from the host name until NS records exist) and resolves every name server to its addresses with the server's resolver.
• Queries SOA, NS, A, AAAA, CNAME, MX, TXT and CAA directly at each authoritative name server (first public IPv4 address; private addresses are never contacted), at Google and Cloudflare DNS-over-HTTPS and at the local resolver.
• Propagation: different SOA serials between authoritative servers mean secondaries have not yet transferred the latest zone; public resolvers answering differently hold cached data until the TTL expires (or serve location-dependent answers).
• Lame delegation: a listed name server that refuses, fails (SERVFAIL/NXDOMAIN) or returns no SOA for the zone. Glue: in-zone name servers need A/AAAA glue at the parent; a name server name that does not resolve is flagged.
• DNSSEC: DS record at the parent (Google DoH) plus the AD (authenticated data) flag from Google and Cloudflare; DS present but SERVFAIL everywhere = bogus.
• History: each live check stores a snapshot of the authoritative records under sha256(domain); the next check lists added/removed values per record type (up to 20 snapshots kept).