Nameserver Consistency Check

Why This Check Exists

Using multiple authoritative nameservers is basic DNS hygiene. It improves availability and makes sure your domain keeps resolving even if one server is unreachable.

What often gets overlooked is that redundancy only works if every nameserver answers the same way. Resolvers do not always query the same server. They pick one based on latency, caching, or resolver behavior. If different nameservers return different answers, DNS stops being predictable. Sometimes things work, sometimes they break, and the failures look random from the outside.

This kind of issue often goes unnoticed until it starts affecting email delivery, HTTPS connections, or traffic routing.

The Problem in Real Environments

Nameserver inconsistencies usually come from very ordinary operational mistakes:

• DNS records edited manually on one server only
• Partial DNS migrations between providers
• Secondary nameservers failing to sync zones correctly
• Old records removed in one place but still present elsewhere
• Split DNS setups that were never fully cleaned up

When this happens, different nameservers respond with different data for the same domain. That can mean one nameserver returning an outdated A record, another returning a different MX record, or TXT records like SPF or DMARC being present on some servers but missing on others.

From a troubleshooting perspective, this is painful. From a security perspective, it creates blind spots and unexpected exposure.

What This Check Verifies

The Nameserver Consistency check queries each authoritative nameserver directly and compares the responses.

It does not rely on cached resolver data. Every nameserver is asked the same question, and the results are compared side by side.

If one nameserver returns different records, values, or TTLs, the check flags the mismatch. This helps surface problems that normal DNS monitoring often misses.

How to Fix the Issue

The first step is identifying where DNS changes are supposed to happen. If you are using a primary and secondary nameserver setup, confirm which server is the authoritative source of truth. All changes should originate there.

Recommended Actions

• Trigger a full zone transfer to all secondary nameservers instead of relying on incremental updates
• Query each authoritative nameserver manually and compare A, AAAA, MX, TXT, and NS records
• Remove any records that exist on only one nameserver
• Verify that SOA serial numbers match across all servers
• Avoid making direct edits on secondary nameservers, even for temporary fixes

Verification Commands

A simple sanity check looks like this:

# Query ns1 for your main records
dig @ns1.example.com example.com A +short
dig @ns1.example.com example.com MX +short
dig @ns1.example.com example.com TXT +short

# Query ns2 for the same records
dig @ns2.example.com example.com A +short
dig @ns2.example.com example.com MX +short
dig @ns2.example.com example.com TXT +short

# Compare SOA serial numbers
dig @ns1.example.com example.com SOA +short
dig @ns2.example.com example.com SOA +short

Once all nameservers return identical data, DNS behavior becomes predictable again and many downstream issues disappear.