Name server (NS) check: lame delegation, one NS, mismatched SOA serials
Name servers medium DNS · 5 of 100 points
What it inspects
The NS records for the zone (the nearest parent that has them, if the name itself is not a zone). Each name server's public IPv4 addresses (up to 2 each, up to 8 servers) are asked directly for the SOA. Verdicts: PASS when there are at least two name servers, all answer authoritatively and SOA serials match. WARN for differing serials, only one name server, or all server addresses in one /24. FAIL when no NS records are found, or when a name server does not answer or is lame. SKIP if none could be probed or all timed out (possibly our network).
Why it matters
If a listed name server does not serve your zone, some queries fail at random. A single name server, or several on one network, is a single point of failure for your site and mail.
How to verify by hand
# bash
dig +short NS example.com
dig +short SOA example.com @ns1.example.net
# PowerShell
Resolve-DnsName -Name example.com -Type NS
Resolve-DnsName -Name example.com -Type SOA -Server ns1.example.net
Run the SOA query against each name server; the serial (third field) should match.How to fix
List at least two name servers on different networks, make every one serve the full zone, and keep zone transfers working.
-
Remove name servers from the delegation at your registrar if they no longer serve the zone.
-
Make sure at least two independent servers are delegated:
example.com. IN NS ns1.example.net. example.com. IN NS ns2.example.org. -
If serials differ, check that zone transfers from the primary to the secondaries succeed.