Bulk NS consistency checker: do all of a domain's name servers agree?
In short: Paste domains and see each one's NS records, with every name server asked directly for the domain's SOA serial, so servers out of sync or not serving the zone stand out. Limit: Only each name server's IPv4 address is queried, and private or reserved addresses are skipped.
A bulk NS consistency checker asks every name server of a domain the same question. Paste up to 100 domains, or 500 after a free Google sign-in, and each row lists the domain's NS records, the SOA serial each server returns, and whether any server fails to answer or doesn't serve the zone at all. DNS queries only. Download the results as CSV.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. Check your list free nowSee pricing
Sample result
globex.example's two name servers return different SOA serials; acme.example's agree.
- Domain
- globex.example
- ns1
- 2026111102
- ns2
- 2026110901
What this means for you
A difference that lasts means a secondary isn't syncing, so some resolvers get old records.
- Every name server asked directly
- SOA serials compared
- Lame delegations flagged
- Dead servers shown; CSV out
- NS
- SOA
- Lame
By SimpleVerifier Team · Last updated
Auditing the email DNS of a domain list?
- Paste the domains here: up to 100 a run, or 500 after a free Google sign-in. Filter to the rows that need a fix and download the CSV.
- Upload or paste it at /verify. Every address gets a live mailbox check, and the first 100 email checks are free with a Google sign-in, no card.
How do I check that a domain's name servers agree?
- Paste domains, email addresses or URLs, one per line, up to 100 a run or 500 after a free Google sign-in.
- Press Check name servers. Each domain's NS records are read, then each name server's public IPv4 address is asked directly for the domain's SOA record, 5 domains a request.
- Read each row: Consistent, Serials differ, A server isn't answering, One name server, No NS records, or Lookup failed, with every server's serial and result.
- Run any odd row again before acting, then filter to the domains that need a fix and download the CSV.
Example
- You enter
- Three domains:
acme.example(two name servers that agree),globex.example(one server on an older serial) andinitech.example(one listed server doesn't serve the zone). - You get
- acme.example: Consistent, both servers answered with the same serial. globex.example: Serials differ, with each server's serial. initech.example: A server isn't answering, naming it as a lame delegation. Download the CSV.
- Limits
- Up to 100 a run without an account and 500 when signed in with Google, counted over a minute. 5 domains a request; DNS only, one SOA query to each name server.
What does a name server consistency check show?
A domain's zone is served by two or more name servers. One is the primary and the rest copy from it. The SOA record carries a serial number that increases with every change, so when all servers return the same serial they hold the same version of the zone. RFC 1035 defines the SOA record and its serial.
If one server returns an older serial than the others, it hasn't picked up the latest change, and some people will get old answers, including old MX and SPF records. That is how a mail record edit appears to work for some senders and not others.
What is a lame delegation?
A lame delegation is a name server listed in a domain's NS records that doesn't actually serve the domain (RFC 8499 defines the term). It is asked about the zone and answers with an error or an empty response. Resolvers waste time on it, and if it is one of only two servers, half of the lookups can fail or slow down.
This tool reports it as a server that didn't give an authoritative answer. It also reports servers that don't answer at all before the timeout, which can be a one-off, so run an odd row again before you change anything.
What does the check not tell me?
A few minutes of different serials right after an edit is normal, because secondaries pick up changes on a refresh or a notification. The check is a snapshot, not a history. It queries each server's IPv4 address only, and it skips private or reserved addresses.
Providers with anycast name servers can answer from many sites, and the check sees whichever site answers it. It tests the zone's SOA, not every record, so two servers with the same serial can still differ if a serial wasn't bumped. For the SOA record on its own, use the bulk SOA record lookup.
Who uses this tool, and for what?
- DNS administrators
- Check every zone after a provider migration or a secondary-DNS change.
- MSPs
- Audit client domains for dead or lame name servers before they cause lookup failures.
- Email administrators
- Make sure MX, SPF and DKIM edits are served the same everywhere.
- Domain investors
- Spot parked or abandoned domains whose name servers no longer answer.
What can’t this tool tell you?
- Only each name server's IPv4 address is queried, and private or reserved addresses are skipped.
- It reads the SOA serial only, not every record in the zone.
- A timeout can be a one-off; run an odd row again before acting.
- Up to 100 domains a run without an account, 500 signed in.
Common questions
- How do I check name server consistency for many domains?
- Paste the domains into a bulk NS consistency checker like this one. It asks every name server directly for the SOA serial and flags servers that differ or don't answer, with a CSV of the results.
- Is this bulk NS consistency checker free?
- Yes. It is a free tool: up to 100 domains a run with no account, and up to 500 a run when you sign in with Google, with no card.
- Why do two name servers show different serials?
- Either a change is still being copied, which clears in minutes, or a secondary isn't syncing, which doesn't. Run the domain again a little later to tell which.
- What does 'not authoritative' mean?
- The server answered but had no SOA for the domain, so it is listed as a name server without serving the zone. Remove it or fix it at the provider.
- Can it check a subdomain?
- A subdomain inside its parent's zone has no NS records of its own and shows No NS records. Check the zone's apex domain instead.
- Does it change anything?
- No. It reads DNS only, one SOA query to each name server.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.