Free domain tool
Ask every delegated nameserver directly and find the one that is listed but does not serve the zone.
Ask a recursive resolver for a domain and it retries nameservers until one answers, so a broken server stays invisible while a share of real lookups quietly slows down or fails. This checker queries each delegated nameserver on its own, which is what makes lame delegation visible.
This reads the child side of the delegation. Parent-side NS records and glue live in the TLD's nameservers and cannot be read through a normal lookup, so nothing here states that the parent delegation matches. For the wider DNS picture, use the DNS Health Check.
It is when a nameserver is listed in a domain's delegation but does not actually serve the zone. Resolvers pick nameservers at random, so some lookups go to the server that cannot answer and are slowed or fail, while others succeed. That intermittency is what makes it hard to notice.
It reads the delegated NS records, then queries each of those nameservers directly instead of asking a recursive resolver. A resolver hides the problem by retrying another server until one answers; asking each server on its own is what exposes the one that cannot.
Because that is what was measured. Reading the authoritative-answer flag in the DNS header requires access this checker does not have, so it reports that the server responded with the zone's NS records — strong evidence it serves the zone, but not the flag itself.
No. Those live in the TLD's nameservers and cannot be read through a normal recursive lookup, so this checker does not report on them and never claims the parent delegation matches. What you see here is the child side of the delegation.
It is a resilience gap rather than a fault. It works today, but there is nothing to fall back to: if that server becomes unreachable the domain stops resolving entirely, taking mail and the website with it. RFC 2182 asks for at least two.
Not necessarily, and it does not affect the score here. Every large DNS provider uses a single name with servers spread worldwide by anycast, so the name alone says nothing about whether they share a network. It is shown for you to judge.
Each nameserver reports its own view of the zone's NS records. If those views differ, the answer a user gets depends on which server their resolver happened to ask, so the domain behaves differently for different people.
It means the NS lookup returned no delegation at all, so there was nothing to check and no score is produced. A nameserver that simply did not reply is also left unassessed rather than being reported as broken — a timeout is not evidence of a misconfiguration.