Nameserver checker
Compare the nameservers your registry delegates to with the NS records inside your zone, and find nameservers that do not answer or do not host the zone.
What this tool checks
For the registered domain (example.com for www.example.com), DNSPeek asks the TLD registry’s nameservers for the delegation, then asks every address of every delegated nameserver for the zone’s NS and SOA records without recursion, and compares the registry’s DS record with the zone’s DNSKEY records. It also shows what a public resolver currently returns, which may still be cached from before a change. IPv6 addresses are listed but not asked, because our checker has no IPv6 connectivity.
How to read the result
“Delegated by .com” is the registry’s list; “In the zone itself” is what the nameservers say about themselves. Each delegated server should answer as authoritative and carry the same SOA serial as the other servers of its provider. Missing or extra names mean the two lists drifted apart, which often happens after moving DNS to a new provider without updating the NS records inside the new zone.
What to check after a migration
Before you change the nameservers at the registrar, make sure the new DNS host already has every record: compare the old and new servers with DNS compare. After the change, run this check again and keep the old zone online until resolvers have picked up the new NS records. The migration playbook covers the order of steps.
Frequently asked questions
What is the difference between the registry delegation and the zone’s NS records?
The delegation is the list of nameservers your registrar sends to the TLD registry (for example .com). Resolvers start there. The zone itself also has NS records, set at your DNS host. Both lists should match; when they differ, some resolvers may follow servers you no longer use.
How does DNSPeek read the delegation?
It asks one of the TLD’s own nameservers directly, without recursion, for your domain. The TLD server answers with a referral that lists the delegated nameservers and their glue addresses, exactly as the registry has them, without any cache in between.
What is a lame delegation?
A nameserver that is delegated at the registry but does not host your zone, so it refuses or answers without authority. Resolvers that pick it fail or slow down. Add the zone at that provider, or remove the server at your registrar.
How long does a nameserver change take?
The registry usually publishes the change within minutes, but resolvers keep the old NS records until their TTL runs out, often up to 48 hours. Keep the zone working at both the old and the new DNS host until then.
Why do the SOA serials differ?
Each nameserver serves a copy of the zone with a version number (the SOA serial). Within one provider, different serials mean a change has not reached every server yet, or a secondary server has stopped transferring the zone. A zone served by two providers (for example NS1 and Route 53) has a separate serial at each, so the checker compares serials within a provider only.
What is a stale DS record?
With DNSSEC, the registry publishes a DS record that names the key your DNS host signs the zone with. Move to a new DNS host without updating or removing the DS, and the keys no longer match: validating resolvers such as Google, Cloudflare and Quad9 then fail the whole domain. The checker compares the DS key tag with the DNSKEY records on the nameservers and tells you to fix the DS at the registrar.
Moving a site to a new server?
See the site on the new server before you change DNS: DNSPeek gives you one HTTPS preview link that works on any device and that you can share with your team or client. No hosts file, no VPN.
Create a free preview link