Nameserver Health Checker

Complete Guide to Nameserver Management & Health

Authoritative nameservers are the servers configured by a domain owner that contain the actual zone files. When a user requests a record, the authoritative nameservers answer with the definitive IP mapping.

To ensure high availability and prevent single-point-of-failure outages, ICANN requires domains to configure at least **two separate nameservers**, preferably hosted in different IP subnets and physical networks. If one server goes offline, the other handles query traffic seamlessly.

1. Primary vs Secondary Nameservers

In traditional DNS architecture, nameservers use a Master-Slave (Primary-Secondary) model:

• Primary Nameserver: The single server where the domain administrator makes zone updates directly.
• Secondary Nameserver: Read-only servers that copy zone updates from the primary server automatically via a process called **Zone Transfer** (AXFR or IXFR protocols).

2. Understanding SOA (Start of Authority) Records

The **SOA (Start of Authority)** record contains critical administrative metadata regarding the zone, specifically governing synchronization:

• Serial Number: An integer representing the current version of the zone file. It often follows a date format (e.g. `2026071501`). When updates are made, this serial increases. Secondary servers compare serials to determine if they need to fetch zone updates.
• Refresh: Time in seconds secondary servers wait before asking the primary nameserver if the serial has changed (typically 86400 seconds / 24 hours).
• Retry: Time secondary servers wait to retry if the primary nameserver fails to respond (typically 7200 seconds / 2 hours).
• Expire: Max time secondary servers will keep responding to queries if the primary nameserver remains unreachable (typically 3600000 seconds / ~41 days).

3. Lame Delegations and Glue Records

- Lame Delegation: Occurs when a registrar delegates domain control to a nameserver, but that nameserver is not configured to serve records for the domain. This results in resolution failures.
- Glue Records: If your domain nameservers are subdomains of the domain itself (e.g., nameserver is `ns1.yourdomain.com`), a circular dependency occurs: to find the IP of `yourdomain.com` you must resolve `ns1.yourdomain.com`. To break this loop, registry registrars publish **Glue Records** (A/AAAA records mapping the nameserver name directly to its IP) in the parent zone registry.