VSPIC
DNS Tools

Root Nameserver Checker — TLD Delegation & NS Trace

Inspect TLD-step nameservers and SOA in a delegation trace from the top-level zone downward

How to Use This Tool

  1. Enter the domain whose TLD delegation you want to inspect.
  2. Labels build zone suffixes from TLD length through the full name.
  3. NS and SOA query at each zone cut via public DNS.
  4. The first trace step shows TLD-level nameservers.
  5. Subsequent steps walk toward apex and subdomains.
  6. Compare TLD-step NS against registrar and DNS panel targets.

About This Tool

Root and TLD nameserver delegation determines which DNS host the global resolver tree consults before reaching your zone. Registrar NS updates that never reach the TLD, or stale TLD NS after migrations, cause split-brain resolution. VSPIC root nameserver checker calls dns-trace for the domain you enter, walks zone suffixes starting at the TLD (depth 2 labels), queries NS and SOA at each cut through your full hostname, and returns trace, delegationDepth, authoritativeZone, and summary.

The tool does not query the DNS root zone (.) directly — it begins at the TLD suffix such as com or org, which is where operators practicaly verify root-nameserver and registry delegation concerns. Focus on the first trace steps when auditing TLD-published NS against registrar intent.

Common use cases

  • •View all DNS records of a domain after migration
  • •Confirm DNS records after domain changes
  • •Test for DNS leaks when using a VPN
  • •Debug email delivery with MX and TXT records

Why use VSPIC for ?

  • TLD-step NS visible in first trace entries.
  • Full delegation context through authoritativeZone.
  • SOA serial at each cut for sync debugging.
  • Status text per step for NXDOMAIN triage.
  • Free instant trace — same API as dns-trace-lookup.
  • Copy-friendly JSON for migration tickets.

Root versus TLD in practical DNS audits

True DNS root servers serve the root zone. Registries delegate TLDs to TLD operators who publish NS at com, org, net, and country codes. Operators colloquially ask about root nameservers when they mean TLD delegation — the first trace step this tool returns.

We query from the TLD suffix downward. The first trace entry nameservers are what resolvers fetch from the registry chain for your domain's TLD.

Reading the first trace step

For example.com, the first step zone is com with NS listing .com TLD nameservers. The second step is example.com with your DNS provider's nameservers. Mismatch at step one means global resolution may still hit old TLD NS after registrar edits.

SOA at com is registry metadata — do not confuse with your zone SOA at example.com on later steps.

After registrar NS changes

Updating nameservers at the registrar pushes to TLD on a schedule — not always instant. Re-run root nameserver checker daily until TLD-step NS lists only intended hosts matching your DNS host documentation.

Pair with whois-dns-lookup language when correlating registrar WHOIS NS fields.

Full trace beyond TLD

Later trace steps show apex and subdomain cuts. delegationDepth counts total steps. authoritativeZone is the deepest label — where your records live authoritatively.

Subdomain zone cuts appear as additional steps with their own NS when child zones delegate separately.

SOA serial and secondary NS hygiene

SOA serial at your apex step helps detect stale secondaries — compare against DNS provider panel. TLD-step SOA is less relevant to your daily ops than apex SOA on the example.com step.

Document serial before and after zone transfers.

ccTLD and registry-specific behavior

Country-code TLDs may impose additional transfer locks or NS propagation delays. Trace timestamps in exports prove when TLD NS still showed legacy values during disputes.

International brands audit each TLD in a portfolio separately.

Relationship to dns-trace-lookup and recursive-dns-checker

All missing tools sharing dns-trace walk the same hierarchy. root-nameserver-checker emphasizes TLD-first interpretation. dns-trace-lookup is general delegation debugging.

recursive-dns-checker also uses dns-trace — choose page by search intent, not different API behavior.

Glue and lame delegation

Trace returns NS hostnames without resolving glue. If TLD NS targets in-bailiwick nameservers, follow with A lookup on those hostnames when glue issues suspected.

Lame delegation requires testing whether NS targets respond authoritatively.

API action dns-trace

GET /ip-tools/api/extended?action=dns-trace&domain=example.com returns trace array — inspect index 0 for TLD NS. Automate post-transfer checks.

Alert when TLD-step nameservers differ from approved list in infrastructure-as-code.

Privacy and responsible use

NS data is public. Trace domains you own or administer.

We do not permanently store queries.

Important notes & limitations

  • Does not query DNS root (.) servers — starts at TLD.
  • Does not resolve glue A/AAAA for in-bailiwick NS.
  • Cannot detect lame delegations without follow-up probes.
  • ccTLD policies may differ — trace logic is generic.
  • One resolver path — internal views may differ.

Frequently Asked Questions

Yes. VSPIC offers this root nameserver checker at no cost with no account required. Results load in real time.

We do not permanently store your queries on our servers. Some tools run entirely in your browser; others fetch public data for the request only.

Yes. Open the page in any modern phone or tablet browser. Results work on Wi‑Fi and mobile data.

No. Trace starts at the TLD suffix (e.g. com) and walks down. That is where TLD nameserver delegation is verified in practice.

The first entry — zone with one label for gTLDs like com, or two labels for some ccTLDs depending on domain length.

Registry propagation delays. Re-check daily until TLD-step NS match your intended DNS provider.

Same dns-trace API and JSON. This page emphasizes TLD and root-delegation audit language.

No. NS hostnames are listed without A/AAAA glue resolution.

dns-trace with a domain parameter.

Next step for your check

Continue with dns trace lookup on VSPIC.

DNS Trace Lookup

Related Tools

Explore more free VSPIC tools for IP, DNS, security, and network diagnostics.

Browse all toolsComparison guides

Trusted by Users Who Value Privacy

Always Free

No premium plan ever

100% Private

Files processed in browser

Instant Results

Convert in seconds

Works Everywhere

Any device, any OS