🩺DNS Zone Health Check
Query every authoritative nameserver of a domain directly (bypassing recursive resolvers) to verify the zone is correctly delegated: synchronized SOA serials, authoritative answers, no open recursion, and TCP support.
Why diagnose DNS delegation?
A domain can resolve fine most of the time and still have a broken delegation: a nameserver with an out-of-sync SOA serial, a misconfigured server that accepts open recursion (a real security risk, since it can be abused in DNS amplification attacks), or a server that only answers over UDP and fails on large responses that require TCP.
Note on Recursion: for an authoritative nameserver, a green check under "Recursion" means the server correctly refused to act as an open recursive resolver — not that recursion is enabled. An authoritative server that does resolve external domains is a security misconfiguration.
What each column checks:
- Serial Sync: the SOA record's serial matches across every nameserver in the zone.
- Authority: the server responds with the AA (Authoritative Answer) flag set.
- Recursion: the server refuses to resolve domains outside its own zone (no RA flag).
- TCP: the server answers correctly over TCP, not just UDP.