Recursive DNS Checker — Delegation Path & Resolution Chain

A recursive resolver starts with no cached data, learns NS at the TLD, walks delegations, then queries authoritative servers for the final QNAME. If any delegation step publishes wrong or lame NS, recursion fails or returns stale answers even when the zone file at the intended host is perfect.

Checking recursion in practice means validating the delegation chain and authoritative reachability — our trace surfaces the chain; follow-up queries on each NS hostname confirm liveness.

Each trace entry includes zone suffix, nameserver list, optional SOA string, and status from Google Public DNS queries. delegationDepth counts steps from TLD; authoritativeZone is the deepest label queried.

Summary text states how many delegation steps were walked. Empty nameservers at an intermediate step is a red flag for recursive failures affecting all public users.

Open resolver tests detect misconfigured servers that answer arbitrary queries from the internet — a security issue. This page does not send amplification probes or scan UDP port 53 broadly. It inspects delegation data your domain publishes for resolvers to consume.

Pair with DoH test tools when validating encrypted recursive paths; use this checker when delegation itself is suspect after NS migrations.

Lame delegation occurs when parent NS point to hosts that do not serve the child zone. Status text and empty answers at a step hint at lameness — confirm by querying each listed NS directly for the zone SOA.

After registrar NS updates, recursive users hit old paths until TTL expires. Trace daily during migrations to see TLD NS converge.

Separate child zones (delegated subdomains) add trace steps. Recursive resolvers must follow each cut. Identical NS at parent and child often means one zone file serves both — still valid, but different from separate DNS accounts per subdomain.

authoritativeZone tells you which suffix owns edits when opening provider tickets.

Identical dns-trace backend and JSON. Recursive DNS checker emphasizes resolution-path language for NOC and helpdesk searches; DNS trace lookup emphasizes delegation documentation. Choose the page that matches your team's vocabulary.

DNS hosting provider finder uses the same action with vendor identification framing.

Internal recursive servers may override public delegations with private zones. This tool reflects the public internet chain — employees may resolve differently inside VPN. Compare internal dig results when split horizon is deployed.

Authoritative fixes must publish on the NS listed at the TLD step for public users.

Schedule GET /ip-tools/api/extended?action=dns-trace&domain=example.com after DNS Terraform applies. Fail CI when nameserver sets drift from approved baselines or delegationDepth changes unexpectedly.

Attach trace JSON to incident tickets when recursive resolution complaints spike regionally.

We query via Google Public DNS, not an interactive iterative walk from root hints. Outcomes match most public recursive behavior for well-formed zones. Hidden primary setups and DNSSEC validation failures need additional tools.

This checker does not measure resolver latency — use DNS response time test for timing probes.