DNS Traversal

Trace a domain's DNS delegation from a root server through the responsible top-level domain to its authoritative name servers. Compare their NS responses and response times.

Domain name

Queries originate from the petuja.tools server and use only the DNS requests needed for the delegation path.

What this tool does

This tool traces a domain's DNS delegation step by step from a root server through the responsible top-level domain to the last authoritative zone it can determine.

It then queries the delegated name servers individually and compares the parent NS set with the NS RRset each name server publishes itself.

How to use the tool

  1. Enter a domain without a protocol, path, port or email address, then start the traversal.
  2. Review the delegation path, analyzed zone and parent delegation. Then compare response time, AA flag, status and name-server responses for each authoritative server.
  3. The input may also be a host name within a zone; the result then identifies the authoritative zone it actually determines.

Useful applications

  • Trace delegation problems between the root, a TLD and an authoritative zone.
  • Check whether multiple authoritative name servers publish the same NS RRset.
  • Compare the response time and reachability of authoritative servers in a point-in-time check.

Notes and limitations

  • The parent delegation comes from the authority section at the previous stage. A child NS RRset comes from the direct answer of each authoritative name server; a mismatch does not automatically prevent every DNS lookup, but it can indicate an inconsistent configuration.
  • The measurement runs from the petuja.tools server. DNS configuration, network conditions and response times can change, so this is a point-in-time check rather than continuous monitoring.
  • The tool does not perform complete DNSSEC validation or cryptographic DS and DNSKEY chain verification.

Frequently asked questions

What does a warning for a name server mean?

A warning means that the server responded but, for example, omitted AA, returned no NS RRset or returned a different NS set from the parent delegation.

Are the results continuous monitoring?

No. Each run is a single server-side measurement and no history is stored.

More tools in DNS

View all tools in DNS