Test DNS servers and settings for a domain name

Enter a domain name to check if its DNS servers are configured correctly

Example: "mydomain.com"


DNS servers

Troubleshooting guide


Adress is invalid or incorrect.

Pingdom: The string you provided was not a syntactically correct IPv4 or IPv6 address. Please try again.




Private IPv4 address.

Pingdom: The address you provided was in a block marked "Private" in RFC 1918.




Reverse for - points to an unknown host name.

Pingdom: A reverse lookup for the address you provided returned a hostname where queries (for A and AAAA records) either didn't return a reply packet, or returned reply packets with ANSWER sections empty.




Could not find reverse address.

Pingdom: A reverse lookup for the address you provided didn't return a reply packet at all. Or a reply packet with an empty ANSWER section.




Reserved IPv4 address.

Pingdom: The address you provided was in a block marked "Reserved" in RFC 3330 or RFC 5735.




Reserved IPv6 address.

Pingdom: The address you provided was in a block marked "Reserved" in RFC 5156.




Not announced.

Pingdom: The specified IP address was not announced by any ASN (Autonomous System Number).




Name server (ip) announced by: (ip)

Pingdom: Team Cymru has the provided IPv4 address listed. The list may be empty.




Zone announced by more than one ASN.

Pingdom: The total number of ASNs (Autonomous System Numbers) in which the name servers for the zone being tested has listed IPv4 addresses is greater than one.




Name server not announced by any AS.

Pingdom: The provided IPv4 address is not listed in any ASN (Autonomous System Numbers)




Zone announced by fewer than two IPv4 ASN.

Pingdom: The total number of ASNs (Autonomous System Numbers) in which the name servers for the zone being tested has listed IPv4 addresses is zero or one.




Name server announced over IPv6 by: (ip)

Pingdom: Team Cymru has the provided IPv6 address listed as announced by an ASN. This list may be empty though.




Zone announced by more than one IPv6 ASN.

Pingdom: The total number of ASNs (Autonomous System Numbers), in which the name servers for the zone being tested, is either zero or more than one.




Name server is not announced by any IPv6 AS.

Pingdom: The provided IPv6 address is not listed in any ASN.




Zone announced by fewer than two IPv6 ASN.

Pingdom: The total number of ASNs (Autonomous System Numbers) in the name server, for the zone tested, has listed IPv6 addresses as exactly one.




Different SOA records found.

Pingdom: The digests calculated from the SOA records were not the same from all listed name servers when returned. The number of different digests seen is included in this message.




Different serials found.

Pingdom: The SOA serial numbers fetched from all the listed name servers were not the same, in both the zone itself and its parent. The number of different serial numbers is included in this message.




Not enough nameserver information was found to test the zone, but an IP address lookup succeeded in spite of that.

Pingdom: Delegation for the zone is broken in such manner that a query for an A record in the zone succeeded, but no child-side name servers could be found. Testing can't proceed but some users will consider the zone working.




Test for zone was marked as undelegated, but no working fake glue was provided.

Pingdom: We tried to run an undelegated test without any fake glue.




Additional name server listed at child.

Pingdom: The name appeared in the list of name servers taken from the child side, but not in the list from the parent side.




Superfluous name server listed at parent.

Pingdom: This name appeared in the list of name servers from the parent side, but not in the list from the child side.




Child glue found.

Pingdom: A name server listed on the parent side had an A or AAAA record on at least one of the parent-side name servers. Then an identical record was also found on at least one of the child-side name servers.




Parent glue found.

Pingdom: An A or AAAA record for a name server was found on at least one of the parent-side name servers.




Missing glue at child.

Pingdom: A query to a child-side name server for a glue record, found at the parent side, resulted in either an unexpected result or an empty response.




Inconsistent glue for name server.

Pingdom: On at least one of the parent-side a name server listed, there was an A or AAAA record and a record with the same name but different content was found on at least one of the child-side name servers.




Nameserver is listed for zone without address information.

Pingdom: An NS record with a name (in the zone listed, and for the zone tested) was found on the parent side. But no corresponding A or AAAA record was found.




No name servers found at child.

Pingdom: No NS records for the zone being tested were found on the child-side.




Delegation not found at parent.

Pingdom: No NS-records for the zone being tested were found on the parent-side.




Total parent/child glue mismatch.

Pingdom: The set of NS names on parent-side and child-side are disjoint. The addresses associated with the parent-side NS records lead to at least one child-side name server so delegation to the zone works.




No IPv4 name servers found.

Pingdom: In the set of NS-records for the zone tested, no IPv4 addresses were returned from a recursive query to the global DNS tree.




No IPv6 name servers found.

Pingdom: In the set of NS records for the zone tested, no IPv6 addresses were returned from a recursive query to the global DNS tree.




Previously used name server %s (%s) is still authoritative for %s.

Pingdom: A server stored in MySQL, as a previous name server for the zone, answered with the AA flag set to a SOA query for the zone.




Too few name servers.

Pingdom: The lists of name servers on the parent-side and child-side had only one name in common.




Too few IPv4 name servers (%s).

Pingdom: In the set of NS-records, for the zone being tested, only one IPv4 address was returned from similarly global recursive A queries.




Too few IPv6 name servers (%s).

Pingdom: In the set of NS-records, for the zone being tested, only one IPv6 address was returned from similarly global recursive AAAA queries.




It is possible to build a referral packet that works without EDNS0.

Pingdom: Given the NS RRset from a randomly chosen child-side nameserver, and A and AAAA records for those name from global recursive queries, it was possible to construct a referral packet of 512 octets or less containing a QUERY section with a maximum-length name, an AUTHORITY section with NS records for all nameservers and an ADDITIONAL holding an A record for an in-zone name server (if any) and an AAAA record for an in-zone name server (if any).




The smallest referral packet we could build for %s was %s bytes, which requires EDNS0 and will not work with old resolvers.

Pingdom: Given the same constraints as for MIN_REFERRAL_SIZE_OK, we could not build a packet of 512 octets or less. This zone will not be resolvable without EDNS0.




Name server blacklisted.

Pingdom: The specified name server will not be queried, because it has been blacklisted.




DNS lookup error.

Pingdom: A DNS query sent resulted in either no response at all, with rcode FORMERR, or a response with rcode SERVFAIL, that was not caused by a server timeout.




Name server not authoritative for.

Pingdom: A response to a query explicitly sent to a particular server was received, but was discarded since it didn't have the AA flag set. And the caller of the query_explicit() method had requested to only get authoritative responses.




No answer received when querying.

  • Didn't have rcode NOERROR
  • Didn't have rcode SERVFAIL and was a query for a SOA record
  • Didn't have rcode FORMERR
  • Was a return packet
  • Was not a timeout



  • Failed to find name servers.

    Pingdom: The method to query child-side name servers, didn't find any child-side name servers.




    EDNS not supported.

    Pingdom: A response with rcode FORMERR was received for a query, with the bufsize or DNSSEC flags turned on.




    Failed to find parent of %s/%s.

    Pingdom: Finding the parent zone of a DNS name failed.




    Failed to find name servers.

    Pingdom: The method to query parent-side name servers didn't find any parent-side name servers.




    Domain does not exist.

    Pingdom: Finding the parent zone of a DNS name didn't produce a result.




    DNS resolver timed out in query.

    Pingdom: A query sent to one or more name server timed out.




    DNS SERVFAIL when querying %s for SOA.

    Pingdom: A response with SERVFAIL rcode was given to a query for a SOA record.




    Unable to send queries.

    Pingdom: The Net::IP module didn't consider the address to be the type "PUBLIC" or "GLOBAL-UNICAST"




    DNSSEC additional processing broken.

    Pingdom: Query for DNSKEY with the DNSSEC flag set, returned a packet without any RRSIG records. But a direct RRSIG query to a randomly chosen child-side server did however return one or more RRSIG records.




    Algorithm number is private.

    Pingdom: The algorithm ID you used in a DNSKEY or DS record, was marked private.




    Algorithm number is reserved.

    Pingdom: The algorithm ID you used in a DNSKEY or DS record, was marked reserved.




    Algorithm number is unassigned.

    Pingdom: The algorithm ID you used in a DNSKEY or DS record was unassigned.




    Did not find DNSKEY record for child.

    Pingdom: None of the child-side nameservers returned any DNSKEY records.




    Not enough valid signatures found.

    Pingdom: The DNSKEY RRset doesn't contain a key that signs the set.




    DNSKEY is marked as a secure entry point (SEP).

    Pingdom: The DNSKEY record with the given key tag has the "Secure Entry Point" flag set.




    Found RRSIG (DNSKEY) created by unpublished key.

    Pingdom: The DNSKEY RRset was signed with an RRSIG having a key tag that wasn'y found on any of the DNSKEY records.




    DNSKEY is not a DNSSEC key.

    Pingdom: The DNSKEY record had a protocol field that wasn't set to 3.




    DNSKEY is not a zone key.

    Pingdom: The DNSKEY record didn't have the zone key flag bit set.




    Found DS record for (IP) at parent.

    Pingdom: At least one of the parent-side nameservers returned a DS record for the zone you're testing.




    Parent refers to invalid key at child.

    Pingdom: The DS record for the zone returned by the the parent-side name servers, doesn't correctly sign any of the DNSKEY records that is returned by the child-side name servers.




    Parent does not refer to secure entry point (SEP) at child.

    Pingdom: The DNSKEY records received from the child-side name servers contain at least one with the Secure Entry Point flag set. But the DS record on the parent-side doesn't sign a DNSKEY record with that flag set.




    Parent refers to secure entry point (SEP) at child.

    Pingdom: The DS record for the zone found on the parent-side name servers correctly signs a DNSKEY record from the child-side name servers, that has a the Secure Entry Point flag set.




    Not all servers has DNSSEC extra processing turned on.

    Pingdom: Some of the child-side name servers included RRSIG records with the answer when queried for DNSKEY records. This with the DNSSEC flag set in the query, while some didn't.




    Inconsistent security for DS found at parent, but no DNSKEY found at child.

    Pingdom: A DS record for the zone was found at the parent name servers, but no DNSKEY records were returned the child-side.




    Broken chain of trust - DNSKEY found at child, but no DS was found at parent.

    Pingdom: At least one of the child-side name servers returned at least one DNSKEY record for the zone. But no DS record was found on the parent-side servers.




    Did not find DS record at parent.

    Pingdom: A DS query to the parent-side servers didn't return any such records at all.




    Nameserver does not do DNSSEC extra processing.

    Pingdom: When asked for DNSKEY records with the DNSSEC flag set in the query, the stated name server didn't include RRSIG records with the answer.




    No signatures found.

    Pingdom: An RRSIG query to the child-side name servers didn't return any such records at all.




    The zone has published DS records, but none of them work.

    Pingdom: So either no DS record was found, or none of those that were found did correctly sign a valid DNSKEY on the child-side.




    DNSSEC signature expired.

    Pingdom: The RRSIG's you specified have validity period that is expired according to the local machine clock.




    DNSSEC signature expires.

    Pingdom: The RRSIG being looked at is inside its validity period, according to the system clock. And it will expire at the time stated.




    DNSSEC signature fails to validate the RR set.

    Pingdom: Cryptographic verification of the given RRSIG over the specified RRset and DNSKEY failed.




    DNSSEC signature not yet valid.

    Pingdom: The validity period for that specified RRSIG hasn't arrived yet. At least not according to the system clock.




    No DNSKEY found at child, other tests skipped.

    Pingdom: Abort checking DNSSEC, since no child-side nameserver returned any DNSKEY records.




    Not enough valid signatures over SOA RRset found.

    Pingdom: So either the SOA RRset didn't come with RRSIG records, or none of the RRSIG that did come with it, were valid and cryptographically sound.




    Found RRSIG (SOA) created by published key.

    Pingdom: The SOA RRset came accompanied with RRSIG records, but the RRSIG records were signed with a key that wasn't found in the zone's DNSKEY RRset.




    Delivery over IPv4 could not be done.

    Pingdom: SMTP tests over IPv4 on all mail hosts failed.




    Basic View
    Advanced View

    Performing test 1 of 6.