DNS reports and nameserver monitoring

Find the nameserver that disagrees.

A successful DNS lookup tells you that one resolver found an answer. Pingy looks deeper: it queries authoritative nameservers, compares their answers and checks how the domain is delegated. The report gives you the records, response times and findings needed to investigate an inconsistent or broken configuration.

The DNS report for pingy.io, cropped to the nameserver comparison. Open the live report for current results.

Pingy DNS report showing authoritative server responses, SOA serials and parent delegation

Pingy DNS report showing authoritative server responses, SOA serials and parent delegation

The DNS report for pingy.io, cropped to the nameserver comparison. Open the live report for current results.

Follow the delegation

A domain depends on the parent zone directing resolvers to the right nameservers. A stale delegation can keep sending queries to a server you thought you had retired. Pingy compares the parent referral with the nameservers published inside the zone.

Parent delegation
The nameservers returned by a parent-zone server, with the server queried and its response time.
Why it mattersEstablish which servers resolvers are being directed to before changing website records.
Parent and zone agreement
Differences between the parent nameserver set and the zone's own NS records.
Why it mattersFind incomplete provider moves or nameserver changes that were only made in one place.
Glue records
Address records supplied by the parent for nameservers that live inside the delegated domain.
Why it mattersMissing required glue can create a circular lookup dependency.
Authority and lame delegation
Whether a listed nameserver responds authoritatively for the domain.
Why it mattersA reachable DNS server can still be the wrong server for your zone.

Compare the authoritative servers

Look across the server rows before treating a single green result as the whole story. Address differences can be deliberate with geographic routing; compare findings with your provider's configuration. A shared SOA serial is useful evidence of synchronization, but it does not by itself prove every record matches.

Reachability and response time
Direct-query latency for each nameserver, plus average and slowest response.
Why it mattersSeparate an unreachable server from a server that answers slowly.
SOA serials
The zone version each authoritative server reports.
Why it mattersDifferent versions can point to a lagging secondary or an incomplete zone update.
A record consistency
The returned IPv4 address sets, compared without depending on answer order.
Why it mattersFind servers still directing visitors to an old origin.
TTL values
Record cache lifetimes and differences observed between servers.
Why it mattersUnderstand how long cached answers may remain. A TTL difference is informational and deserves a recheck.
Redundancy and network diversity
Nameserver count and diversity of their IPv4 /24 networks.
Why it mattersSpot obvious concentration. Different subnets alone do not prove independent providers or failure domains.
TCP and recursion
DNS-over-TCP responses and whether a server answers a recursive query for an unrelated zone.
Why it mattersCheck transport support and detect exposed recursion on authoritative infrastructure.
Nameserver IPv6 records
Whether nameserver hostnames publish AAAA records.
Why it mattersReview IPv6 addressing. Record presence alone is not an end-to-end IPv6 connectivity test.

Read the zone settings and mail records

The report groups findings by parent delegation, nameservers, SOA, mail, web and security. Each row includes the evidence and a pass, warning, failure or informational result. Optional records and unavailable answers need context; they are not interchangeable with an outage.

SOA primary and serial format
The primary server name and the format of the zone serial.
Why it mattersReview the source of the zone. Hidden primaries and non-date serials can be valid configurations.
Refresh, retry and expire
SOA timers and the relationship between retry and refresh intervals.
Why it mattersUnderstand how secondary servers update and how long they can retain a zone without a successful refresh.
Negative cache TTL
The SOA value used when reviewing negative-answer caching.
Why it mattersConsider how long a cached missing-name answer can outlive a newly added record.
MX targets and priorities
Mail exchanger hostnames, preferences, address resolution and CNAME use.
Why it mattersFind a mail destination that cannot resolve or points through an unsuitable alias.
SPF and DMARC
Published SPF records and the DMARC policy found for the domain.
Why it mattersInspect mail policy and duplicate SPF records. These DNS checks do not test inbox delivery or DKIM signatures.
Web resolution
Address resolution for the monitored host and www, including detected aliases.
Why it mattersCatch a working apex with a broken www hostname, or the reverse.
DNSSEC and signature expiry
DNSSEC signals, delegation checks and available RRSIG expiration data.
Why it mattersInvestigate signing problems that can cause validating resolvers to reject answers.
CAA policy
Certificate-authority authorization records published in DNS.
Why it mattersReview which issuers are authorized before changing certificate providers.

After a DNS provider change

Compare the parent delegation with the new provider's assigned nameservers. Then inspect each authoritative response for the expected address set and zone serial. If one server differs, fix the authoritative configuration before assuming cached answers are the only problem.

Once the servers agree, allow for answers already cached by resolvers and run another check. Keep the collection time with the result when sharing it with your DNS provider.

Common questions

Does Pingy check every resolver on the internet?

No. The authoritative report compares the servers discovered for your domain and uses recursive lookups for supporting records. It does not measure worldwide propagation through every ISP resolver.

Does every warning mean my website is down?

No. Some findings identify configuration risks or optional records. Read the evidence and compare it with your intended setup. The DNS health grade summarizes delegation, redundancy, performance, zone hygiene, security and mail.

DNS incident walkthrough

From “something’s wrong” to a useful next step.

Here’s how a website owner can use Pingy’s evidence to investigate a problem.

01 · OBSERVATION

Nameserver 1 192.0.2.10 Nameserver 2 192.0.2.20

Nameservers disagree

Two authoritative servers return different A records after a DNS change. The DNS report shows each answer and its collection time.

02 · INTERPRETATION

Current server Old server

Visitors may reach different servers

Compare the regional checks and the change timeline. The timing suggests a connection; it does not prove the cause.

03 · ACTION

Verify recovery

Correct the zone and verify

Review the records with your DNS provider, allow for cached answers, then check again. Keep monitoring to observe recovery.

Choose your monitoring plan.

Pro and Enterprise run scheduled DNS audits hourly. A free public check produces a one-time report. DNS report data has its own collection time; an uptime check does not imply that every DNS test just ran. Scheduled alerts can flag nameserver changes, persistent SOA disagreement, lame delegation, DNSSEC changes, expiring signatures and CAA changes.

Free

Keep an eye on personal sites.

$0up to 5 sites
per month
Start free
Website checks
Hourly (best-effort)
Monitoring regions
1 region per siteChoose from 12 global stations
Scheduled DNS reports
Not included
SSL & domain reports
Not scheduled
Notification channels
EmailIntegrations not included

Enterprise

Our fastest checks and widest coverage.

$9.99per site
per month
Choose Enterprise
Website checks
Every minute
Monitoring regions
8 regions per siteChoose from 12 global stations
Scheduled DNS reports
Every hour
SSL & domain reports
Every day
Notification channels
EmailApprise integrations included

Screenshots and SEO data on every plan.

Plans apply per site. Mix Free, Pro and Enterprise in one account. Free needs no card.

Just need a report?

Run 3 free public checks per 24 hours, including DNS, SSL, domain details and a screenshot. Scheduled audits are included with Pro and Enterprise.

Check your site