Skip to the tool

Delegation NS, SOA & DNSSEC

See how a domain is delegated: nameservers, their networks, the SOA timers and whether the zone is signed.

Check a domain's delegation

Domain name example.com

Enter a domain and click "Check delegation".
The NS records say which servers are authoritative for the zone; the SOA and DNSSEC data describe how it is run.

What this tool cannot see

A web page cannot open raw UDP or TCP connections, so it can only ask recursive resolvers over HTTPS (DNS-over-HTTPS). It never talks to the authoritative servers itself. That means:

No lame-delegation test. Whether each listed nameserver actually answers authoritatively for the zone is not verified.
No parent-versus-child NS comparison. A resolver returns one merged NS set; the parent's delegation (and glue) and the child zone's own NS records cannot be told apart.
No per-server SOA serial comparison. Only the serial that the resolvers saw is shown, not the serial of each nameserver.

What is done instead: the same NS, SOA and DS questions go to two independent resolvers, dns.google and cloudflare-dns.com (both allow cross-origin requests). If they agree, they see the same data at this moment. If they differ, the cause is either cache age or authoritative servers that disagree; it cannot tell which, and agreement does not prove every nameserver is healthy. For a full lame-delegation test run a tool such as dig +trace or delv from a machine with direct DNS access.