Nameserver consistency: every server, one answer

nameserver consistency

Do this zone's authoritative servers hold the same copy: one SOA serial at every address, and the same NS set and records at the addresses asked?

check runs the domain check (/#check?d=), which asks each nameserver and shows them side by side. sweep opens the sweep (/api/sweep?domain=, JSON; sweep_domain over MCP), which asks the SOA serial at every address and the other rows at a sample of the addresses, RD=0 over TCP. The reading below is the sweep's.

read

These lines read the sweep's output (the reading below, /api/sweep, sweep_domain). The domain check the form runs shows each nameserver side by side with its own ok, warn and fail rows.

GO one SOA serial at every address, every address asked (8 asked on the 8-address zone below, no sampled) and no row reading disagree, lame or silent: every row shaped like the NS row below, 8 agree on 8 addresses. The reading below as a whole is not one: its serial and A rows disagree.
NO GO servers disagree on the SOA serial and on a record row too: not every address serves the same copy -> zone operator: the address with the older serial (RFC 1982 section 3.2) has not loaded the latest zone (the transfer, RFC 1034 section 4.3.5), unless the zone is served from several places by design, as the reading below shows for google.com, where the A rows differ by address too.
NO GO disagree on a record row with one serial everywhere, a lame address or a silent one -> zone operator: the zone edited at one provider only, or a listed server that does not load it.
NOT RUN servers disagree on the SOA serial with every record row agreeing: the serial alone does not decide. Two providers' serial schemes read the same way as lag (RFC 1982: serial number arithmetic); the record rows are the reading.
NOT RUN sampled in the first line, or a NOT ASKED line naming an address: the sweep asked a sample of the addresses for the record rows, so a row's count covers the addresses it names and no other. Not a GO for the rest (here every address was asked: 8 asked).

example

google.com, @, SOA, NS and A, read 2026-10-18T23:10:25Z:

  isitdns · sweep · google.com · 8 server addresses, 8 asked · from Cloudflare edge, IAD · read 2026-10-18T23:10:25.855Z
  parent l.gtld-servers.net (192.41.162.30): NS ns2.google.com, ns1.google.com, ns3.google.com, ns4.google.com; DS none
  google.com SOA servers disagree: ns1.google.com. dns-admin.google.com. 1001768049 900 900 1800 60 at 2 addresses asked from the edge; ns1.google.com. dns-admin.google.com. 1001407091 900 900 1800 60 at 6 addresses asked from the edge; serials differ: 1001768049 at 2 addresses, 1001407091 at 6 addresses
  google.com A servers disagree: 142.251.179.100, 142.251.179.101, 142.251.179.102, 142.251.179.113, 142.251.179.138, 142.251.179.139 at 4 addresses asked from the edge; 192.178.218.100, 192.178.218.101, 192.178.218.102, 192.178.218.113, 192.178.218.138, 192.178.218.139 at 4 addresses asked from the edge
  google.com NS ns1.google.com., ns2.google.com., ns3.google.com., ns4.google.com., 8 agree
  google.com CAA 0 issue "pki.goog", 8 agree
  _acme-challenge.google.com TXT NXDOMAIN, 8 agree
  _acme-challenge.google.com CNAME NXDOMAIN, 8 agree
  cert google.com: CAA at google.com governs issuance for google.com (RFC 8659 section 3); no TXT at _acme-challenge.google.com: nothing is published for a DNS-01 challenge right now
    CAA at google.com: 0 issue "pki.goog"

  id   question                        vantage  server          address               rcode     flags  ms     asked (UTC)               answer
  r01  google.com SOA                  edge     ns2.google.com  216.239.34.10         NOERROR   aa=1   30 ms  2026-10-18T23:10:25.655Z  google.com SOA ns1.google.com. dns-admin.google.com. 1001768049 900 900 1800 60 (ttl 60)
  r02  google.com SOA                  edge     ns2.google.com  2001:4860:4802:34::a  NOERROR   aa=1   30 ms  2026-10-18T23:10:25.655Z  google.com SOA ns1.google.com. dns-admin.google.com. 1001407091 900 900 1800 60 (ttl 60)
  r03  google.com SOA                  edge     ns1.google.com  216.239.32.10         NOERROR   aa=1   24 ms  2026-10-18T23:10:25.655Z  google.com SOA ns1.google.com. dns-admin.google.com. 1001407091 900 900 1800 60 (ttl 60)
  r04  google.com SOA                  edge     ns1.google.com  2001:4860:4802:32::a  NOERROR   aa=1   17 ms  2026-10-18T23:10:25.655Z  google.com SOA ns1.google.com. dns-admin.google.com. 1001407091 900 900 1800 60 (ttl 60)
  r05  google.com SOA                  edge     ns3.google.com  216.239.36.10         NOERROR   aa=1   33 ms  2026-10-18T23:10:25.655Z  google.com SOA ns1.google.com. dns-admin.google.com. 1001407091 900 900 1800 60 (ttl 60)
  r06  google.com SOA                  edge     ns3.google.com  2001:4860:4802:36::a  NOERROR   aa=1   19 ms  2026-10-18T23:10:25.710Z  google.com SOA ns1.google.com. dns-admin.google.com. 1001768049 900 900 1800 60 (ttl 60)
  r07  google.com SOA                  edge     ns4.google.com  216.239.38.10         NOERROR   aa=1   24 ms  2026-10-18T23:10:25.655Z  google.com SOA ns1.google.com. dns-admin.google.com. 1001407091 900 900 1800 60 (ttl 60)
  r08  google.com SOA                  edge     ns4.google.com  2001:4860:4802:38::a  NOERROR   aa=1   8 ms   2026-10-18T23:10:25.716Z  google.com SOA ns1.google.com. dns-admin.google.com. 1001407091 900 900 1800 60 (ttl 60)
  r17  google.com A                    edge     ns2.google.com  216.239.34.10         NOERROR   aa=1   15 ms  2026-10-18T23:10:25.701Z  google.com A 142.251.179.100 (ttl 300); google.com A 142.251.179.113 (ttl 300); google.com A 142.251.179.101 (ttl 300); google.com A 142.251.179.102 (ttl 300); google.com A 142.251.179.138 (ttl 300); google.com A 142.251.179.139 (ttl 300)
  r33  _acme-challenge.google.com TXT  edge     ns2.google.com  216.239.34.10         NXDOMAIN  aa=1   15 ms  2026-10-18T23:10:25.733Z  empty
  38 receipts not printed here; all of them: api: https://isitdns.net/api/sweep?domain=google.com&names=%40&types=SOA%2CNS%2CA

api: https://isitdns.net/api/sweep?domain=google.com&names=%40&types=SOA%2CNS%2CA

This reading earns the first NO GO line: servers disagree on the serial and on the A row, 8 agree on NS and CAA. The sweep reads the disagreement; that google.com is served from several places by design is the operator's knowledge, not the sweep's, so the badge stands as read.

from your own machine

for ns in $(dig +short example.com NS); do echo "$ns $(dig +norec +short @"$ns" example.com SOA | awk '{print $3}')"; done

One line per server, the serial after its name. Add -4 or -6 to pin the address family.

the manual

Check an authoritative server: the one command and the aa flag
Zone transfers: how a secondary gets the copy
RFC 1034 section 4.3.5: zone maintenance and transfers · RFC 1982: serial number arithmetic

other jobs