VSPIC
DNS Tools

Authoritative DNS Checker — Delegation & NS Verification

Confirm which nameservers authoritatively serve your zone — delegation trace with SOA at each cut

How to Use This Tool

  1. Enter the domain to verify authoritative delegation for.
  2. Hostname validation normalizes the public DNS name.
  3. dns-trace queries NS and SOA at each zone suffix from TLD upward.
  4. Each trace step exposes nameserver hostnames and SOA string.
  5. authoritativeZone names the deepest delegation step — your authoritative cut.
  6. Match NS hostnames against DNS provider documentation and registrar WHOIS.

About This Tool

Authoritative DNS hosts publish zone truth — recursive resolvers only cache what those nameservers answer. Misdelegation at the TLD, wrong NS in registrar panels, or stale SOA serials break mail and HTTPS before application logs show errors. VSPIC authoritative DNS checker runs dns-trace on the domain you enter, walking from TLD suffix through each zone cut to your full name, returning trace steps with zone, nameservers, SOA, status, plus delegationDepth, authoritativeZone, and summary identifying the deepest zone served.

authoritativeZone tells you which label owns the zone file editors must update. Nameservers at that step are the authoritative NS set the internet expects. Compare against your DNS provider panel before closing migration tickets.

Common use cases

  • •View all DNS records of a domain after migration
  • •Confirm DNS records after domain changes
  • •Test for DNS leaks when using a VPN
  • •Debug email delivery with MX and TXT records

Why use VSPIC for ?

  • authoritativeZone pinpoints which label owns zone edits.
  • NS listed at deepest step are authoritative nameservers in practice.
  • SOA per step aids MNAME and serial verification.
  • Full trace documents delegation chain for audit tickets.
  • Free verification — same dns-trace API as trace lookup.
  • Structured JSON for CI post-change authoritative checks.

Authoritative versus recursive DNS

Recursive resolvers fetch answers on behalf of clients and cache them. Authoritative servers answer for zones they own — NS records at delegation points tell recursives which authoritative hosts to query next.

This checker walks delegation to expose authoritative NS hostnames and SOA at each zone cut. It does not replace logging into your DNS panel — it verifies public internet delegation matches intent.

authoritativeZone interpretation

authoritativeZone is the deepest zone suffix in the trace — where the delegation walk stops for your input name. For simple apex domains it is usually the apex (example.com). Separate child zone cuts make a subdomain the authoritative zone.

Zone file edits for records on that label happen at the DNS host serving NS on that step.

SOA as authority metadata

SOA includes primary master (MNAME) and responsible mailbox (RNAME encoded as DNS labels). Serial increments on zone changes — compare serial across trace steps when debugging secondary sync.

Unexpected SOA MNAME may reveal hidden primary clusters distinct from marketing NS names.

Registrar and TLD alignment

Authoritative DNS is useless if TLD NS still point elsewhere. First trace step must list NS matching your provider. WHOIS registrar NS fields should agree with trace — lag indicates incomplete transfer.

Run checker daily during NS migration until stable.

Glue and lame delegation

If authoritative NS are under the same zone (in-bailiwick), parent must publish glue A/AAAA. Trace lists NS hostnames only — follow with A lookup on each NS if resolution fails.

Lame delegation shows NS hostnames that do not answer for the zone — trace status and external dig @ tests detect lameness.

Relationship to dns-hosting-provider-finder

Both use dns-trace. Hosting provider finder emphasizes vendor identification from NS patterns. Authoritative checker emphasizes verifying correct delegation and authoritativeZone for operations.

JSON is identical — complementary interpretation.

Child zone delegations

delegated.sub.example.com may show authoritativeZone sub.example.com when sub is separately delegated. Apex NS differ from child NS — do not edit apex panel when child owns its own zone.

delegationDepth greater than label count minus one signals extra cuts.

API action dns-trace

GET /ip-tools/api/extended?action=dns-trace&domain=example.com returns trace, authoritativeZone, delegationDepth. Fail CI when authoritativeZone NS drift from approved list.

Store trace exports with migration evidence.

Privacy and authorization

Delegation is public data. Verify domains you manage or audit under contract.

Provider identification from NS patterns is operational guidance, not legal proof.

Important notes & limitations

  • Infers authority from delegation walk — not direct AXFR or NOTIFY tests.
  • Does not resolve glue A for in-bailiwick NS automatically.
  • Single resolver path — split-horizon internal authority differs.
  • Child delegations may make subdomain the authoritativeZone.
  • Vanity NS obscure vendor without reverse lookups.

Frequently Asked Questions

Yes. VSPIC offers this authoritative DNS checker at no cost with no account required. Results load in real time.

We do not permanently store your queries on our servers. Some tools run entirely in your browser; others fetch public data for the request only.

Yes. Open the page in any modern phone or tablet browser. Results work on Wi‑Fi and mobile data.

The deepest zone label in the delegation trace — where zone files for your name are authoritatively served.

dns-trace with a domain parameter.

No. It walks public delegation with NS and SOA queries, not AXFR from authoritative servers.

Separate child zone delegations make the child label the authoritative cut — not an error.

Query A and AAAA on each NS hostname listed at the authoritative step. Trace does not include glue automatically.

Nameserver lookup returns NS for one QNAME. Authoritative checker walks full delegation chain with SOA context at each cut.

Next step for your check

Continue with dns trace lookup on VSPIC.

DNS Trace Lookup

Related Tools

Explore more free VSPIC tools for IP, DNS, security, and network diagnostics.

Browse all toolsComparison guides

Trusted by Users Who Value Privacy

Always Free

No premium plan ever

100% Private

Files processed in browser

Instant Results

Convert in seconds

Works Everywhere

Any device, any OS