DNS Root Server Lookup — TLD Delegation & NS Trace
Walk delegation from TLD suffix through your domain — NS and SOA at each step including root-adjacent zones
How to Use This Tool
- Enter the domain whose delegation chain you want to trace.
- Hostname is validated and normalized.
- dns-trace queries NS and SOA at each zone suffix from TLD length upward.
- Each trace step lists zone label, nameserver hostnames, SOA string, and status.
- delegationDepth counts steps; authoritativeZone is deepest zone walked.
- Inspect first trace step for TLD nameserver set — root-adjacent delegation truth.
About This Tool
The DNS hierarchy starts at root, delegates to TLD operators, then to your authoritative DNS host. When operators ask which root or TLD nameservers serve a domain, they need delegation trace — not a guess from WHOIS panels. VSPIC DNS root server lookup runs dns-trace on the domain you enter, walking zone suffixes from the TLD (two labels) through your full hostname, querying NS and SOA at each cut, returning trace array, delegationDepth, authoritativeZone, and summary.
The first trace step exposes TLD-level nameserver hostnames — the delegation layer immediately below DNS root in practice for public operators. Use output to verify registry NS updates propagated and TLD NS match your intended DNS provider after migrations.
Common use cases
- •View all DNS records of a domain after migration
- •Confirm DNS records after domain changes
- •Test for DNS leaks when using a VPN
- •Debug email delivery with MX and TXT records
Why use VSPIC for ?
- TLD-step NS visible in first trace row — root-adjacent delegation.
- Full chain through authoritativeZone for complete context.
- SOA per step aids serial and master NS verification.
- delegationDepth quantifies zone cuts for documentation.
- Free instant trace — same API as dns-trace-lookup.
- Structured JSON for migration and audit tickets.
Root, TLD, and authoritative layers
DNS root servers (a.root-servers.net through m.root-servers.net) delegate TLD zones like com and org. TLD nameservers delegate your apex to your DNS host. Recursive resolvers walk this chain automatically — operators debugging delegation replicate that walk explicitly.
Our trace starts at the TLD suffix (example.com → com step first) because that is the operational root-adjacent layer for most domain troubleshooting. Literal root NS are stable and rarely misconfigured — TLD delegation errors dominate incident tickets.
Reading the first trace step
trace[0].zone is the TLD label (com, net, org). trace[0].nameservers lists TLD NS hostnames serving referral to your apex. If these disagree with registrar NS listing, registry update is incomplete.
SOA at TLD step is TLD operator metadata — less critical than NS hostnames for your migration, but useful when documenting chain of authority.
delegationDepth and authoritativeZone
delegationDepth equals trace.length — number of zone suffixes walked. authoritativeZone is the deepest zone label, usually your apex unless child delegations exist.
Subdomain delegations produce deeper authoritativeZone (delegated.example.com) — interpret depth before assuming apex ownership.
Migration and registrar cutover
After NS change at registrar, first trace step should list only target provider NS. Stale TLD NS referencing old host means global resolution still hits wrong authoritative cluster.
Trace daily during migration windows until TLD step stabilizes.
Glue and in-bailiwick NS limits
Trace returns NS hostnames, not glue A/AAAA. In-bailiwick NS under the same zone need glue for resolution bootstrap — query each NS hostname with A lookup if resolution loops are suspected.
Out-of-bailiwick NS (ns.cloudflare.com for example.com) do not need glue at parent.
Relationship to root-nameserver-checker and dns-trace-lookup
All use dns-trace API. root-nameserver-checker emphasizes TLD-first audit language. dns-trace-lookup is general delegation debugging. DNS root server lookup targets root and TLD search terminology.
JSON shape is identical — choose page by team vocabulary.
WHOIS correlation
WHOIS lists registrar-published NS. Trace shows live TLD referral. Mismatch is the smoking gun for partial registrar updates.
Pair with whois DNS lookup and nameserver lookup for complete picture.
API action dns-trace
GET /ip-tools/api/extended?action=dns-trace&domain=example.com returns trace, delegationDepth, authoritativeZone, summary. Automate post-transfer verification in CI.
Flag domains whose TLD-step NS fall outside approved provider suffix lists.
Privacy and authorization
Delegation data is public. Trace domains you own, manage, or investigate legitimately.
We do not permanently store searches.
Important notes & limitations
- Does not query literal root (.) NS interactively — starts at TLD suffix.
- Does not resolve glue A records for in-bailiwick nameservers.
- Single public resolver path — not multi-vantage root probes.
- Vanity NS may obscure DNS vendor identity.
- Child zone delegations change authoritativeZone depth.
Frequently Asked Questions
Yes. VSPIC offers this DNS root server lookup at no cost with no account required. Results load in real time.
We do not permanently store your queries on our servers. Some tools run entirely in your browser; others fetch public data for the request only.
Yes. Open the page in any modern phone or tablet browser. Results work on Wi‑Fi and mobile data.
Trace starts at the TLD suffix step — the root-adjacent layer operators need for domain delegation. Literal root NS are not walked interactively.
dns-trace with a domain parameter.
The first trace row — zone is the TLD label (com, net, etc.) with TLD NS hostnames in nameservers.
Registrar panel updates may lag registry delegation. Trace shows live TLD referral truth.
No. Query A records on each NS hostname separately if glue is suspected broken.
Same dns-trace API and JSON. This page emphasizes root and TLD delegation language for root server lookup searches.
Next step for your check
Continue with dns trace lookup on VSPIC.
Related Tools
Explore more free VSPIC tools for IP, DNS, security, and network diagnostics.
DNS Trace Lookup
Walk delegation chain from TLD to domain with NS and SOA at each step
Use Free →Root Nameserver Checker
Root Nameserver Checker — free online tool
Use Free →Nameserver Lookup
Registration and DNS nameserver delegation for any domain
Use Free →Recursive DNS Checker
Recursive DNS Checker — free online tool
Use Free →DNS Lookup Tool — DNS Checker
Free DNS lookup tool and DNS checker — query A, AAAA, MX, TXT, NS, CNAME, and SOA records for any domain.
Use Free →Reverse DNS Lookup
Resolve IP addresses to hostnames via PTR records
Use Free →
Trusted by Users Who Value Privacy
Always Free
No premium plan ever
100% Private
Files processed in browser
Instant Results
Convert in seconds
Works Everywhere
Any device, any OS