# DNS reports and nameserver monitoring

Source: https://pingy.io/features/dns-reports

Find the nameserver that disagrees.

A successful DNS lookup tells you that one resolver found an answer. Pingy looks deeper: it queries authoritative nameservers, compares their answers and checks how the domain is delegated. The report gives you the records, response times and findings needed to investigate an inconsistent or broken configuration.

## Follow the delegation

A domain depends on the parent zone directing resolvers to the right nameservers. A stale delegation can keep sending queries to a server you thought you had retired. Pingy compares the parent referral with the nameservers published inside the zone.

### Parent delegation

The nameservers returned by a parent-zone server, with the server queried and its response time.

Establish which servers resolvers are being directed to before changing website records.

### Parent and zone agreement

Differences between the parent nameserver set and the zone's own NS records.

Find incomplete provider moves or nameserver changes that were only made in one place.

### Glue records

Address records supplied by the parent for nameservers that live inside the delegated domain.

Missing required glue can create a circular lookup dependency.

### Authority and lame delegation

Whether a listed nameserver responds authoritatively for the domain.

A reachable DNS server can still be the wrong server for your zone.

## Compare the authoritative servers

Look across the server rows before treating a single green result as the whole story. Address differences can be deliberate with geographic routing; compare findings with your provider's configuration. A shared SOA serial is useful evidence of synchronization, but it does not by itself prove every record matches.

### Reachability and response time

Direct-query latency for each nameserver, plus average and slowest response.

Separate an unreachable server from a server that answers slowly.

### SOA serials

The zone version each authoritative server reports.

Different versions can point to a lagging secondary or an incomplete zone update.

### A record consistency

The returned IPv4 address sets, compared without depending on answer order.

Find servers still directing visitors to an old origin.

### TTL values

Record cache lifetimes and differences observed between servers.

Understand how long cached answers may remain. A TTL difference is informational and deserves a recheck.

### Redundancy and network diversity

Nameserver count and diversity of their IPv4 /24 networks.

Spot obvious concentration. Different subnets alone do not prove independent providers or failure domains.

### TCP and recursion

DNS-over-TCP responses and whether a server answers a recursive query for an unrelated zone.

Check transport support and detect exposed recursion on authoritative infrastructure.

### Nameserver IPv6 records

Whether nameserver hostnames publish AAAA records.

Review IPv6 addressing. Record presence alone is not an end-to-end IPv6 connectivity test.

## Read the zone settings and mail records

The report groups findings by parent delegation, nameservers, SOA, mail, web and security. Each row includes the evidence and a pass, warning, failure or informational result. Optional records and unavailable answers need context; they are not interchangeable with an outage.

### SOA primary and serial format

The primary server name and the format of the zone serial.

Review the source of the zone. Hidden primaries and non-date serials can be valid configurations.

### Refresh, retry and expire

SOA timers and the relationship between retry and refresh intervals.

Understand how secondary servers update and how long they can retain a zone without a successful refresh.

### Negative cache TTL

The SOA value used when reviewing negative-answer caching.

Consider how long a cached missing-name answer can outlive a newly added record.

### MX targets and priorities

Mail exchanger hostnames, preferences, address resolution and CNAME use.

Find a mail destination that cannot resolve or points through an unsuitable alias.

### SPF and DMARC

Published SPF records and the DMARC policy found for the domain.

Inspect mail policy and duplicate SPF records. These DNS checks do not test inbox delivery or DKIM signatures.

### Web resolution

Address resolution for the monitored host and www, including detected aliases.

Catch a working apex with a broken www hostname, or the reverse.

### DNSSEC and signature expiry

DNSSEC signals, delegation checks and available RRSIG expiration data.

Investigate signing problems that can cause validating resolvers to reject answers.

### CAA policy

Certificate-authority authorization records published in DNS.

Review which issuers are authorized before changing certificate providers.

## After a DNS provider change

Compare the parent delegation with the new provider's assigned nameservers. Then inspect each authoritative response for the expected address set and zone serial. If one server differs, fix the authoritative configuration before assuming cached answers are the only problem.

Once the servers agree, allow for answers already cached by resolvers and run another check. Keep the collection time with the result when sharing it with your DNS provider.

## Scheduled monitoring

Pro and Enterprise run scheduled DNS audits hourly. A free public check produces a one-time report. DNS report data has its own collection time; an uptime check does not imply that every DNS test just ran. Scheduled alerts can flag nameserver changes, persistent SOA disagreement, lame delegation, DNSSEC changes, expiring signatures and CAA changes.

## Does Pingy check every resolver on the internet?

No. The authoritative report compares the servers discovered for your domain and uses recursive lookups for supporting records. It does not measure worldwide propagation through every ISP resolver.

## Does every warning mean my website is down?

No. Some findings identify configuration risks or optional records. Read the evidence and compare it with your intended setup. The DNS health grade summarizes delegation, redundancy, performance, zone hygiene, security and mail.

[DNS record and SOA reference (RFC 1035)](https://www.rfc-editor.org/rfc/rfc1035)