Recursive DNS Lookup — Delegation Path Trace

Recursive resolvers cache answers but cold resolution walks NS delegations from the TLD until reaching authoritative servers for the QNAME. If any step publishes wrong NS, recursion fails or returns stale data despite a correct zone file at the intended host.

dns-trace documents that delegation structure — the same prerequisite check NOC teams run before blaming application DNS.

Action dns-trace with domain parameter. Each trace step queries NS and SOA at zone suffixes built from the TLD upward through your full hostname. No live iterative query chain from root servers is executed in your browser.

summary states how many delegation steps were walked — empty nameservers at an intermediate step is a red flag.

Each entry includes zone, nameservers array, optional SOA string, and status text. delegationDepth counts steps; authoritativeZone is the deepest label queried.

Compare NS sets against registrar panel and dns-history snapshot exports for holistic migration evidence.

Propagation checker siblings use dns-history for record snapshots with queriedAt — honest current publication, not global polling. Recursive lookup uses dns-trace for delegation chain — complementary diagnostics during NS migrations.

Use both after registrar changes: trace confirms chain; snapshot documents leaf records with timestamp.

open-resolver-test runs doh-test against four public DoH providers for A records — encrypted resolver reachability, not delegation walk. recursive-dns-lookup inspects published NS/SOA delegation — not open recursion scanning.

Choose tool by failure mode: delegation break versus DoH answer mismatch.

Lame delegation occurs when parent NS point to hosts not serving the child zone. Empty nameservers or error status at a step hints lameness — query listed NS directly for zone SOA to confirm.

Re-trace daily during NS migrations until TLD NS converge on intended targets.

Delegated child zones add trace steps. Recursive resolvers must follow each cut. Identical NS at parent and child may mean one zone serves both — valid but different from separate DNS accounts per subdomain.

dname-record-lookup sibling shares dns-trace backend with DNAME-oriented SEO language.

GET /ip-tools/api/extended?action=dns-trace&domain=example.com. Parse trace, delegationDepth, authoritativeZone. Fail CI when NS sets drift from approved baselines after Terraform applies.

Attach JSON to change tickets when delegation breaks after cutover.

Trace public delegation for domains you administer or troubleshoot with permission. Results reflect public DNS.

We do not store trace queries permanently.