A successful DNS lookup tells you that one resolver found an answer. Pingy looks deeper: it queries authoritative nameservers, compares their answers and checks how the domain is delegated. The report gives you the records, response times and findings needed to investigate an inconsistent or broken configuration.
The DNS report for pingy.io, cropped to the nameserver comparison. Open the live report for current results.
Follow the delegation
A domain depends on the parent zone directing resolvers to the right nameservers. A stale delegation can keep sending queries to a server you thought you had retired. Pingy compares the parent referral with the nameservers published inside the zone.
What Pingy recordsWhy it matters
Parent delegation
The nameservers returned by a parent-zone server, with the server queried and its response time.
Why it mattersEstablish which servers resolvers are being directed to before changing website records.
Parent and zone agreement
Differences between the parent nameserver set and the zone's own NS records.
Why it mattersFind incomplete provider moves or nameserver changes that were only made in one place.
Glue records
Address records supplied by the parent for nameservers that live inside the delegated domain.
Why it mattersMissing required glue can create a circular lookup dependency.
Authority and lame delegation
Whether a listed nameserver responds authoritatively for the domain.
Why it mattersA reachable DNS server can still be the wrong server for your zone.
Compare the authoritative servers
Look across the server rows before treating a single green result as the whole story. Address differences can be deliberate with geographic routing; compare findings with your provider's configuration. A shared SOA serial is useful evidence of synchronization, but it does not by itself prove every record matches.
What Pingy recordsWhy it matters
Reachability and response time
Direct-query latency for each nameserver, plus average and slowest response.
Why it mattersSeparate an unreachable server from a server that answers slowly.
SOA serials
The zone version each authoritative server reports.
Why it mattersDifferent versions can point to a lagging secondary or an incomplete zone update.
A record consistency
The returned IPv4 address sets, compared without depending on answer order.
Why it mattersFind servers still directing visitors to an old origin.
TTL values
Record cache lifetimes and differences observed between servers.
Why it mattersUnderstand how long cached answers may remain. A TTL difference is informational and deserves a recheck.
Redundancy and network diversity
Nameserver count and diversity of their IPv4 /24 networks.
Why it mattersSpot obvious concentration. Different subnets alone do not prove independent providers or failure domains.
TCP and recursion
DNS-over-TCP responses and whether a server answers a recursive query for an unrelated zone.
Why it mattersCheck transport support and detect exposed recursion on authoritative infrastructure.
Nameserver IPv6 records
Whether nameserver hostnames publish AAAA records.
Why it mattersReview IPv6 addressing. Record presence alone is not an end-to-end IPv6 connectivity test.
Read the zone settings and mail records
The report groups findings by parent delegation, nameservers, SOA, mail, web and security. Each row includes the evidence and a pass, warning, failure or informational result. Optional records and unavailable answers need context; they are not interchangeable with an outage.
What Pingy recordsWhy it matters
SOA primary and serial format
The primary server name and the format of the zone serial.
Why it mattersReview the source of the zone. Hidden primaries and non-date serials can be valid configurations.
Refresh, retry and expire
SOA timers and the relationship between retry and refresh intervals.
Why it mattersUnderstand how secondary servers update and how long they can retain a zone without a successful refresh.
Negative cache TTL
The SOA value used when reviewing negative-answer caching.
Why it mattersConsider how long a cached missing-name answer can outlive a newly added record.
MX targets and priorities
Mail exchanger hostnames, preferences, address resolution and CNAME use.
Why it mattersFind a mail destination that cannot resolve or points through an unsuitable alias.
SPF and DMARC
Published SPF records and the DMARC policy found for the domain.
Why it mattersInspect mail policy and duplicate SPF records. These DNS checks do not test inbox delivery or DKIM signatures.
Web resolution
Address resolution for the monitored host and www, including detected aliases.
Why it mattersCatch a working apex with a broken www hostname, or the reverse.
DNSSEC and signature expiry
DNSSEC signals, delegation checks and available RRSIG expiration data.
Why it mattersInvestigate signing problems that can cause validating resolvers to reject answers.
CAA policy
Certificate-authority authorization records published in DNS.
Why it mattersReview which issuers are authorized before changing certificate providers.
After a DNS provider change
Compare the parent delegation with the new provider's assigned nameservers. Then inspect each authoritative response for the expected address set and zone serial. If one server differs, fix the authoritative configuration before assuming cached answers are the only problem.
Once the servers agree, allow for answers already cached by resolvers and run another check. Keep the collection time with the result when sharing it with your DNS provider.
Common questions
Does Pingy check every resolver on the internet?
No. The authoritative report compares the servers discovered for your domain and uses recursive lookups for supporting records. It does not measure worldwide propagation through every ISP resolver.
Does every warning mean my website is down?
No. Some findings identify configuration risks or optional records. Read the evidence and compare it with your intended setup. The DNS health grade summarizes delegation, redundancy, performance, zone hygiene, security and mail.
Pro and Enterprise run scheduled DNS audits hourly. A free public check produces a one-time report. DNS report data has its own collection time; an uptime check does not imply that every DNS test just ran. Scheduled alerts can flag nameserver changes, persistent SOA disagreement, lame delegation, DNSSEC changes, expiring signatures and CAA changes.