Nameserver Lookup

Find the actual zone cut behind a domain or hostname, compare what the parent delegates with what the child publishes, and test each discovered authority without hiding split or unreachable servers.

Parent vs. child NS
Glue and public addresses
Direct authority evidence
SOA and DNSSEC
Root-to-zone trace

Run a nameserver lookup

The useful default is ready, but no DNS request is sent until you choose Check nameservers. URLs, Unicode IDNs, punycode, and trailing dots are normalized before analysis.

Domain or hostname

A hostname, URL, Unicode IDN, punycode name, or absolute name with a trailing dot. The closest authoritative zone is discovered automatically.

Expected nameservers (optional)

One hostname per line, or separate values with spaces or commas. Comparison is case-insensitive and ignores a final dot.

Advanced DNS options

Discovery resolver

Used for zone discovery, nameserver addresses, and validation claims. NS evidence is also queried directly from public authoritative endpoints.

Run protocol checks
Compare plain UDP, EDNS with the DNSSEC OK flag, and TCP against one public address per discovered nameserver. Each analysis may take up to 25 seconds; a hostname below its zone can require a second analysis.

Ready to inspect example.com.

Live public-DNS queries go to Octetify’s same-origin analyzer. Identical authoritative analyses may be cached for up to 60 seconds. Results are a point-in-time view from the analyzer’s network, not a worldwide availability guarantee.

Waiting

Nameserver result

Zone cut—

Delegation—

Authorities—

NS TTL—

DNSSEC—

Findings and next actions

Problems are based on observed DNS evidence; informational notes are kept separate from failures.

Parent, child, and intended NS sets

The parent referral routes resolvers to the zone. The child’s apex NS set is authoritative zone data. They are maintained separately and should agree.

Parent delegation

Child zone

Expected set

Nameserver inventory

Addresses are resolver-discovered public A/AAAA data. “Answered” means at least one direct public endpoint returned a DNS response during this check.

Parent and child nameserver inventory
Nameserver	Set membership	Current public addresses	Direct response	NS TTL	SOA serial

Direct authoritative NS evidence

Every tested address is retained. Agreement is evaluated across canonical NS answer sets and per-server child NS evidence, not by a resolver majority vote.

Per-nameserver direct NS observations
Nameserver	Endpoint	Result	NS answer	TTL	DNS time

Glue and address evidence

In-bailiwick nameservers need parent-side address glue to avoid a circular lookup. Out-of-bailiwick servers normally do not need glue at this zone cut.

Parent glue and current nameserver addresses
Nameserver	Bailiwick	Parent glue	Glue TTL	Current address match	Direct response

SOA replication evidence

The SOA serial identifies a zone version. Different serials are strong evidence that authorities are serving different revisions.

SOA data reported by authoritative nameservers
Nameserver	Primary	Responsible name	Serial	Refresh / retry	Expire / minimum	SOA TTL

Delegation and security detail

The trace follows referrals from the DNS root. DNSSEC status describes validation, not confidentiality or uptime.

Root-to-zone delegation trace

Delegation trace steps
Hop	Current zone	Server	Referral / result	Nameservers	Glue / DS	Time

DNSSEC validation evidence

UDP, EDNS, and TCP checks

DNS protocol checks by authoritative nameserver
Nameserver	Endpoint	Plain UDP	EDNS + DO	TCP

Raw diagnostic evidence

How to read this report and its limits

Zone cut: a hostname can sit below a separately delegated subdomain. This tool reports the closest discovered authoritative zone rather than assuming the last two labels form the zone.
Parent versus child: a mismatch can make resolvers follow a different set from the one published inside the zone. Fix the registrar or parent delegation and the child apex NS set deliberately; changing one does not change the other.
Reachability: a positive row proves an endpoint answered this analyzer at this moment. A timeout may be path-specific, and one vantage point cannot establish worldwide availability.
Glue: parent glue is routing data, not authoritative address data. The report compares it with current public A/AAAA answers when both are available.
Redundancy: nameserver count is shown, but this report does not infer provider, autonomous-system, power, or geographic independence. RFC 2182 recommends real topological and geographic diversity.
TTL: displayed NS TTLs are authoritative configured cache lifetimes, not the remaining lifetime in an arbitrary recursive cache.
Standards: interpretations follow RFC 1034, RFC 2181, RFC 2182, and RFC 4033.