DNS health report

What the report checks

• Delegation: the nameservers the parent zone (the registry, for a registered domain) hands out, compared with the zone's own NS records.
• Every nameserver asked directly: it must answer authoritatively, over UDP and TCP, with the same SOA serial as the others, and must not resolve other domains for the public (an open resolver).
• Glue: a nameserver named inside the zone it serves, such as ns1.example.com for example.com, needs its address published at the parent.
• Diversity: nameservers in more than one network (/24) and, ideally, more than one autonomous system, plus an IPv6 address.
• SOA timers against the usual ranges (RFC 1912), MX targets that are real hostnames, and CAA.
• DNSSEC: the parent's DS record must match a DNSKEY in the zone, a validating resolver must confirm the answers, and the signatures must not be about to expire.

Only ordinary queries are sent. Zone transfers (AXFR) are never attempted.

The problems that take domains offline

• A DS record left at the registrar after moving to a DNS provider that signs with a different key, or doesn't sign at all. Validating resolvers, which serve most internet users, then fail every lookup. Remove or replace the DS before or during the move.
• Lame delegation: the registrar still lists a nameserver that no longer serves the zone. Resolvers that pick it wait for a timeout before trying another, so the site is slow or intermittently fails.
• Missing glue after renaming or renumbering in-zone nameservers. Update the host records at the registrar.
• A firewall that blocks TCP port 53. Small answers still work, so it goes unnoticed until a DNSSEC or large TXT answer needs TCP.

Questions

What is a lame delegation?

A nameserver that the parent zone lists for your domain but that doesn't answer authoritatively for it: it times out, refuses, or answers without the authoritative flag. It usually happens after changing DNS provider without updating every nameserver at the registrar.

Why do my nameservers show different SOA serials?

A secondary hasn't copied the latest version of the zone yet. A difference that clears within minutes is normal right after a change; one that persists means zone transfers or NOTIFY are broken, and that server is serving old records.

All my nameservers are in one AS. Is that bad?

For large anycast providers such as Cloudflare or Route 53 it is normal: one AS spans many sites. It still means a single provider's outage takes the domain offline, which is why some sites add a second DNS provider.

Do the SOA refresh and retry values matter?

Only for secondaries that copy the zone with zone transfers. Many managed DNS providers replicate another way and ignore them. The last field, the negative-caching TTL, always matters: it is how long resolvers remember that a name doesn't exist.

How is this different from a DNS lookup?

A lookup asks one resolver for one record. The health report checks the setup itself: what the parent says, what each nameserver says, and whether they agree.