How to Check That All of a Domain's Name Servers Agree (SOA Serial Check)

To check that a domain's name servers agree, ask each one directly for the domain's SOA record and compare the serial numbers. The bulk NS consistency checker does this for up to 100 domains a run, 500 after a free Google sign-in. Each row lists the NS records, the serial each server returns, and any server that does not answer or does not serve the zone.

What the check shows

A zone is served by two or more name servers. One is the primary and the rest copy from it. The SOA record carries a serial number that increases with every change, so when all servers return the same serial they hold the same version of the zone. RFC 1035 defines the SOA record. If one server returns an older serial, it has not picked up the latest change, and some senders get old answers, including old MX and SPF records. That is how a mail record edit seems to work for some people and not others.

Doing it by hand

dig +short NS example.com
dig +short SOA example.com @ns1.example.net
dig +short SOA example.com @ns2.example.net

List the name servers, then query each one directly with @server and compare the third field of the SOA answer, which is the serial. Repeat for each server and each domain.

Step 1: paste the domains

Paste domains, email addresses or URLs, one per line, up to 100 a run or 500 after a free Google sign-in.

Step 2: run the check

Each domain's NS records are read, then each name server's public IPv4 address is asked directly for the domain's SOA record, 5 domains a request.

Step 3: read each row

Result	What it means	What to do
Consistent	Every server returned the same serial	Nothing to fix
Serials differ	At least one server is on a different version	Run again later; if it persists, fix the secondary
A server isn't answering	No reply before the timeout	Run again before acting; a timeout can be a one-off
One name server	Only one NS record	Add a second server on another network
No NS records	Nothing at the name	Check you pasted the zone's apex domain
Lookup failed	DNS did not answer properly	Try again later

Lame delegations

A lame delegation is a name server listed in a domain's NS records that does not actually serve the domain (RFC 8499 defines the term). It is asked about the zone and answers with an error or an empty response. Resolvers waste time on it, and if it is one of only two servers, a share of lookups can fail or slow down. The tool reports it as a server that did not give an authoritative answer.

What this check cannot do

• A few minutes of different serials right after an edit is normal, because secondaries update on a refresh or a notification.
• Only each name server's IPv4 address is queried, and private or reserved addresses are skipped.
• It reads the SOA serial only, not every record. Two servers with the same serial can still differ if a serial was not raised.
• Anycast providers answer from many sites, and the check sees whichever answers it.

To see the SOA record on its own, use the bulk SOA record lookup. To find who hosts each domain's DNS, see finding the DNS host for a list of domains and where to edit a domain's DNS. For how DNS faults show up in mail, see MX record errors explained.

Check the addresses you send to

Correct DNS gets mail to the door; the address still has to exist. Upload your list on the verify page: the first 100 email checks are free with a Google sign-in, no card. Each address comes back valid, risky or invalid with a reason, and nothing is sent to anyone on the list. For larger or recurring lists, see bulk email verification, list cleaning and pricing.

Check your domains now

Paste them into the bulk NS consistency checker.