Delegation Checkers Don't Agree: DS, NS, and Glue Diagnostics Compared

Running your domain through multiple DNS health checkers often produces frustratingly inconsistent results. One tool reports your delegation is perfect, another flags critical errors, and a third warns about issues the first two never mentioned. This disagreement doesn't necessarily mean any tool is wrong, it reflects the complexity of DNS delegation, different validation methodologies, and timing-dependent checks that catch your infrastructure in different states.

Understanding why delegation checkers disagree, how to interpret their varied results, and which findings actually matter helps you separate real problems from false positives and tool-specific quirks.

What Delegation Checkers Actually Test

DNS delegation involves multiple layers of coordination between parent and child zones, each creating opportunities for misconfiguration that different tools prioritize differently.

Nameserver Records (NS)

The parent zone (your TLD registry) publishes NS records delegating your domain to specific nameservers. Your authoritative nameservers publish their own NS records for your domain. Delegation checkers verify these records match, that all listed nameservers are reachable, and that they respond authoritatively for your domain.

Tools differ in how strictly they enforce matching. Some flag any discrepancy between parent and child NS records as an error, while others accept minor differences if all nameservers respond correctly. Some check whether nameservers are geographically distributed, while others only verify basic reachability.

Glue Records

When your nameservers are within the domain they serve (like ns1.example.com serving example.com), the parent zone must provide glue records, IP addresses for those nameservers. Without glue, circular dependencies prevent resolution: you can't find example.com's nameservers without first resolving example.com.

Delegation checkers test whether necessary glue exists, whether glue addresses are reachable, and whether glue matches the addresses your nameservers themselves report. Different tools apply different heuristics for when glue is necessary and how strictly it must match.

DNSSEC Delegation (DS Records)

For DNSSEC-enabled domains, the parent zone publishes DS (Delegation Signer) records that cryptographically link your zone to the parent. These records must match the DNSKEY records your nameservers publish, creating a chain of trust.

DNSSEC validation is complex, key rollovers, algorithm choices, and timing dependencies create many opportunities for temporary mismatches that some tools flag as errors while others tolerate during transition periods.

Response Consistency

Delegation checkers query multiple nameservers and compare responses. Inconsistent responses, different NS records, different IP addresses, different DNSSEC signatures, indicate synchronization issues or configuration mismatches.

Tools vary in how much inconsistency they tolerate and how they handle temporarily inconsistent responses during legitimate updates.

Why Results Diverge

Several fundamental factors cause delegation checkers to report different findings even when testing the same domain simultaneously.

Query Timing and Caching

DNS relies heavily on caching. When a delegation checker queries your nameservers, it might receive cached responses from recursive resolvers between the checker and your authoritative servers. Different checkers query through different resolver paths with different cache states, receiving different responses.

A tool querying immediately after you updated your zone sees new data, while another tool querying through a resolver with stale cached records sees old data. Both tools report accurately what they observed, but they observed different states of your infrastructure.

Vantage Point Differences

Checkers run from different network locations with different connectivity. A checker in Europe might successfully reach all your nameservers, while a checker in Asia experiences timeouts reaching a specific server due to regional network issues or firewall rules.

Geographic load balancing, anycast routing, and region-specific firewalls can cause dramatically different behavior depending on where queries originate. No single vantage point reveals the full picture of how your DNS behaves globally.

Validation Strictness

Tools implement different interpretations of RFC specifications. Some strictly enforce every SHOULD and MUST in the specifications, flagging any deviation as an error. Others take pragmatic approaches, ignoring minor deviations that don't affect practical functionality.

For example, RFC specifications suggest certain TTL values and nameserver counts, but most configurations outside these recommendations work fine. Strict tools flag these as issues; pragmatic tools ignore them.

Feature Focus

Different checkers emphasize different aspects of DNS health. Security-focused tools exhaustively test DNSSEC configuration while barely checking basic delegation. Performance-focused tools measure response times and check geographic distribution. Compliance-focused tools verify adherence to registry requirements.

This specialization means tools often don't test the same set of conditions, naturally producing different result sets.

Interpreting Parent/Child Mismatches

One of the most common discrepancies delegation checkers report involves mismatches between parent and child zone data.

NS Record Mismatches

When parent and child NS records differ, some configurations work fine while others break. If your child zone lists four nameservers but the parent zone only lists three, queries directly to your authoritative servers see all four nameservers while queries through the delegation path only see three.

Whether this matters depends on which nameservers are missing from the parent. If the parent omits a nameserver that never receives queries anyway, functionality isn't impacted. If the parent omits your primary nameserver, you have a serious problem.

Some delegation checkers flag any mismatch as critical, while others assess whether the mismatch actually affects resolution. Neither approach is wrong, they prioritize different concerns.

Glue Address Mismatches

When glue records in the parent zone don't match the addresses your nameservers report for themselves, resolution might still work if the resolver can independently discover the correct addresses. But it's slower and creates unnecessary complexity.

Some tools flag glue mismatches as critical errors that must be fixed immediately. Others categorize them as warnings, technically incorrect but often not breaking anything in practice. For organizations managing domain registration across multiple providers, glue record synchronization requires careful attention during nameserver changes.

DS Record Issues

DNSSEC DS record problems are particularly timing-sensitive. During key rollovers, legitimate configurations temporarily have DS records that don't match current DNSKEYs. The protocol explicitly allows transition periods where old and new keys coexist.

Aggressive validation tools might flag these transition states as broken DNSSEC, while more sophisticated tools recognize valid rollover patterns and report them differently. Understanding whether you're actively performing a key rollover helps interpret these reports correctly.

Common False Positives

Certain delegation checker warnings frequently appear despite not indicating actual problems requiring fixes.

Nameserver Version Disclosure

Some checkers flag nameservers that respond to version queries (dig version.bind chaos txt) with actual version numbers, claiming this discloses security-relevant information. While hiding versions provides marginal security-through-obscurity, it's not a meaningful security control.

This "issue" appears frequently but rarely justifies remediation effort unless you're specifically required to hide version information for compliance reasons.

Non-Authoritative Answers from Child

Some tools expect your authoritative nameservers to set the Authoritative Answer (AA) flag when responding for your domain. Most properly configured nameservers do this, but some implementations don't consistently set the flag yet still function perfectly.

Unless you're experiencing actual resolution problems, missing AA flags usually don't justify switching nameserver software or providers.

Geographic Distribution Suggestions

Checkers often suggest distributing nameservers geographically for resilience. While this is good practice, many perfectly functional configurations use nameservers in a single location or region. Whether geographic distribution matters depends on your requirements, global services benefit more than local services.

Treating geographic distribution suggestions as informational recommendations rather than critical errors provides appropriate context.

Validating from Multiple Vantage Points

Comprehensive DNS validation requires checking from diverse locations and perspectives, as single-point validation misses important issues.

Regional Testing

Use delegation checkers located in different geographic regions. If your users are global, validation from North America, Europe, Asia, and other regions reveals whether network routing, firewall rules, or regional configurations affect specific locations.

Cloud-based hosting infrastructure often behaves differently across regions, and validation from multiple vantage points catches region-specific issues.

Resolver Diversity

Test through different recursive resolvers. Query through major public resolvers (Google DNS, Cloudflare, Quad9), ISP resolvers, and enterprise resolvers. Different resolver software implements DNS protocols slightly differently, and issues affecting specific resolver types reveal compatibility problems.

Direct vs Recursive Queries

Compare direct queries to your authoritative nameservers (dig @ns1.example.com example.com) with queries through recursive resolvers (dig example.com). Direct queries bypass caching and show exactly what your nameservers return. Recursive queries show what real users experience, including caching effects.

Discrepancies between direct and recursive queries often indicate TTL issues, caching problems, or resolver-specific behaviors worth investigating.

Protocol Variations

Test both UDP and TCP queries. While DNS primarily uses UDP, some queries require TCP (large responses, zone transfers). Ensure your nameservers and firewalls handle both protocols correctly.

Test IPv4 and IPv6 separately. Dual-stack nameservers might work perfectly over IPv4 while having IPv6 connectivity issues that only appear when querying via IPv6.

Tools and Their Tendencies

Understanding different delegation checkers' characteristics helps interpret their results appropriately.

DNSViz provides detailed DNSSEC visualization, making it excellent for debugging DNSSEC issues but potentially overwhelming for basic delegation checks. It's strict about DNSSEC standards and flags technical violations even if they don't break validation.

Zonemaster implements comprehensive checks based on best practices and standards. It categorizes issues by severity, making it easier to prioritize what actually needs fixing. Zonemaster is thorough but can overwhelm with warnings about non-critical issues.

IntoDNS focuses on practical operational issues, reachability, configuration consistency, and common misconfigurations. It's less strict about standards compliance but effective at identifying problems that actually break functionality.

DNSCheck tools from registries often enforce registry-specific requirements that other tools don't test. If your registry's checker reports issues, those matter even if other tools don't flag them, as registry requirements determine whether your delegation is accepted.

Prioritizing What Matters

When delegation checkers disagree, focus on issues that affect actual functionality rather than chasing every reported warning.

Critical Issues: Fix Immediately

Nameservers completely unreachable, all DNSSEC validation failing, parent delegation missing entirely, or glue records incorrect for in-domain nameservers all break resolution and require immediate fixes.

Important Issues: Fix Soon

Some nameservers unreachable, inconsistent responses across nameservers, DNSSEC warnings during non-rollover periods, or parent/child NS mismatches warrant investigation and correction but might not be actively breaking things.

Informational Issues: Evaluate and Decide

Version disclosure, non-optimal TTLs, suggested nameserver distribution improvements, or minor RFC deviations can often be safely ignored unless specific requirements mandate addressing them.

For services managing email infrastructure, DNS delegation issues can affect mail delivery, making prompt resolution of even "minor" issues worthwhile.

Building a Validation Routine

Rather than responding reactively when delegation checkers report problems, establish proactive validation routines.

Run delegation checks after any nameserver changes, DNS configuration updates, or DNSSEC key operations. Validate before and after changes to confirm they achieved intended results without introducing new issues.

Use multiple checkers as part of standard validation, at least one DNSSEC-focused tool, one general-purpose checker, and your registry's validation tool if available. Compare results and investigate discrepancies rather than assuming any single tool is authoritative.

Monitor DNS resolution from multiple vantage points continuously. Synthetic monitoring that periodically queries your domains from different locations catches issues that might not be apparent from single-location checks.

Document expected validation results for your specific configuration. When checkers report the same "issues" repeatedly despite everything working correctly, documenting why those reports are acceptable prevents alarm fatigue and helps future administrators understand intentional configuration choices.

The Bigger Picture

Delegation checker disagreement ultimately reflects DNS's complexity and the internet's diversity. Your DNS infrastructure serves users from countless networks, through myriad recursive resolvers, across varied network conditions. No single tool observes all these perspectives simultaneously.

Rather than seeking unanimous agreement across all delegation checkers, an unrealistic goal, aim for understanding what each tool reveals about different aspects of your DNS health. Each checker provides a piece of the overall picture, and comprehensive validation combines insights from multiple sources.

When results conflict, investigate why rather than assuming error. Understanding the source of disagreement, timing, vantage point, strictness, or feature focus, transforms confusing contradictions into useful diagnostic information that deepens your understanding of how your DNS actually behaves in the wild.