Skip to content
SenderProbe
Routing check

See where a domain's DNS is actually served from

Every other record depends on this one. SenderProbe reads the NS records a domain is delegated to, resolves each nameserver to make a lame delegation visible, and compares what the resolvers it queries have to say about the delegation.

Free to run No mail is sent to your domain

What an NS record is

An NS record names a host that is authoritative for a zone. The set of them is the DNS delegation: the parent zone publishes it to say where answers for the child zone come from, and every resolver in the world follows it to find your MX, SPF, DKIM and DMARC records.

Registries commonly put a long TTL on the delegation — two days is typical — because it changes rarely and every lookup for the domain depends on it. That length is also why a nameserver change is the slowest DNS change there is.

The delegation for example.com: two authoritative nameservers, with the two-day TTL registries commonly apply.
example.com.  172800  IN  NS  ns1.example.net.
example.com.  172800  IN  NS  ns2.example.net.

Lame delegation, and why nobody notices it

A lame delegation is a nameserver named in the delegation that does not answer for the zone: it was decommissioned, it never resolved, or it no longer holds the zone. Resolvers pick from the set more or less at random, so a domain with one lame nameserver out of two still works most of the time. It fails for a fraction of lookups, from a fraction of resolvers, and that intermittency is what makes it survive for years.

SenderProbe resolves each delegated nameserver and says which ones do not resolve at all, which is the cheapest form of this fault to detect.

How many nameservers a domain should have

At least two, and RFC 2182 asks for more than redundancy in name only: the hosts should not share a network, a data centre or a single point of power. Two nameservers in the same rack are one nameserver with extra steps.

A domain delegated to a single nameserver has no protection at all. When that host is unreachable, nothing about the domain resolves — not the website, not the MX record, and not the SPF record a receiver is trying to evaluate while your mail sits in its queue.

The parent's answer and the zone's own

There are two NS sets for every domain. The parent zone publishes the delegation, and the zone itself publishes its own NS records at the apex. They are supposed to match. When a nameserver change is made at the registrar but not in the zone, or the other way round, the two disagree and queries succeed or fail depending on which set a resolver happened to cache.

A nameserver lookup that reads only one of them can report a domain as healthy while half the internet is being sent somewhere else.

What nameserver failure does to mail

Authentication is a DNS query. If the delegation fails, a receiver evaluating SPF gets no answer and records a temporary error rather than a pass; DKIM verification cannot fetch the public key; DMARC finds no policy. Depending on the receiver, the message is deferred, filed as spam, or accepted unauthenticated.

This is why the routing gate is checked before anything else. A domain whose DNS is intermittent has an authentication problem it did not write.

Run this check on your own domain. A workspace takes a minute to create and runs every one of the eleven checks against the domain you name.

Check my domain

Common questions

What is a lame delegation?
A lame delegation is a nameserver listed in a domain's NS records that does not answer authoritatively for the zone, because it was retired, never configured or has lost the zone. Resolvers choose between the delegated servers unpredictably, so the domain resolves most of the time and fails for a share of queries, which is why the fault often goes unnoticed for years.
How many nameservers should a domain have?
At least two, and RFC 2182 recommends they be genuinely independent: different networks, different sites, ideally different providers. Two nameservers hosted in the same rack fail together. A single nameserver means that every name under the domain, including its MX and SPF records, disappears the moment that one host is unreachable.
Do NS records affect email delivery?
Yes, indirectly and severely. Every authentication check a receiver makes is a DNS query against your zone, so a delegation that fails takes SPF, DKIM and DMARC with it. Receivers usually record a temporary error rather than a pass, and the message is deferred or accepted unauthenticated depending on their policy.
Why do the nameservers at my registrar differ from the ones in DNS?
Because the delegation in the parent zone and the NS records inside your own zone are maintained separately, and a change made in one place does not update the other. Resolvers may cache either set, so the mismatch produces answers that are correct from one resolver and wrong from the next. Keep the two identical.

Keep reading

Related checks, definitions and guides.