isitdns?

Delegation trace: root to authority

delegation trace

Which servers does a resolver meet on the way from the root to this name, and does the last one answer for it?

The trace runs in the dig tool, one block per hop, like dig +trace. The same walk as text: trace over MCP, or /api/trace?name=example.com&type=A (JSON).

read
  • GO a referral at each zone cut, then an answer with aa from a server the parent listed.
  • NO GO no answer at the last hop, or an answer without aa: a server the parent lists does not serve the zone (a lame delegation, RFC 9499 section 7) -> zone owner: the NS set at the registrar and in the zone names servers that load the zone (RFC 1034 section 4.2.2).
  • NOT RUN the zone's own NS set against the parent's: the trace reads the parent's referral and the last hop's aa, not the NS set the zone itself holds. dig +norec @<auth> <zone> NS reads it, and a resolver trusts the child's set over the parent's (RFC 2181 section 5.4.1); the comparison is Check a delegation.
example

example.com A, read 2026-10-18T22:02:06Z:

  isitdns · delegation walk · example.com A
  asked: example.com A with RD=0 over TCP from the Cloudflare edge (IAD), theoracle (Phoenix, North America); read 2026-10-18T22:02:06.590Z

  ;; r01 a.root-servers.net (198.41.0.4) from the edge (IAD) · 5 ms · NOERROR · flags: qr
  com. 172800 IN NS l.gtld-servers.net, j.gtld-servers.net, h.gtld-servers.net, d.gtld-servers.net, b.gtld-servers.net, f.gtld-servers.net, k.gtld-servers.net, m.gtld-servers.net, i.gtld-servers.net, g.gtld-servers.net, a.gtld-servers.net, c.gtld-servers.net, e.gtld-servers.net
  glue: 26 addresses for 13 of 13 names (api:)
  ;; r02 l.gtld-servers.net (192.41.162.30) from the edge (IAD) · 16 ms · NOERROR · flags: qr
  example.com. 172800 IN NS hera.ns.cloudflare.com, elliott.ns.cloudflare.com
  glue: hera.ns.cloudflare.com 108.162.192.162 172.64.32.162 173.245.58.162 2606:4700:50::adf5:3aa2 2803:f800:50::6ca2:c0a2 2a06:98c1:50::ac40:20a2 · elliott.ns.cloudflare.com 108.162.195.228 162.159.44.228 172.64.35.228 2606:4700:58::a29f:2ce4 2803:f800:50::6ca2:c3e4 2a06:98c1:50::ac40:23e4
  ;; r03 not asked: hera.ns.cloudflare.com (108.162.192.162) from the edge (IAD): the Cloudflare edge cannot dial this address
  ;; r04 hera.ns.cloudflare.com (108.162.192.162) from theoracle · 25 ms · NOERROR · flags: qr aa
  example.com. 300 IN A 104.20.23.154
  example.com. 300 IN A 172.66.147.243
  RRSIG: 1 (api:)

  parent NS TTL (example.com): 172800 s
  auth A TTL (example.com): 300 s
  referral + authoritative answer (aa)

api: https://isitdns.net/api/trace?name=example.com&type=A
ask again: https://isitdns.net/#dig?name=example.com&qtype=A&resolver=trace
from your own machine
dig @198.41.0.4 example.com A +trace

From a network that leaves port 53 alone: an answer carrying ra came from a recursive server in the root server's place.

the manual
other jobs