inspect.ZONE Delegation-aware DNS Reports Knowledgebase

How DNS resolution works: root, TLD, authoritative

Published September 9, 2026. Updated September 9, 2026.

Every DNS lookup is a short journey down a tree. Understanding it makes almost every report finding easier to read, because each check is really asking "did one step of this journey go the way it should?"

The three tiers

  • Root servers know where every top-level domain (TLD) lives. There are 13 root server identities (a.root-servers.net through m), served from hundreds of locations by anycast.
  • TLD / registry servers run a zone like .com, .org, or .co.uk. They do not hold your records; they hold the delegation - the list of nameservers responsible for your domain - and glue where needed.
  • Authoritative nameservers are yours (or your DNS provider's). They hold the real records: A, AAAA, MX, TXT, and so on.

A lookup, step by step

To resolve www.example.com:

  1. Ask a root server for .com. It answers with a referral to the .com nameservers.
  2. Ask a .com server for example.com. It answers with a referral to your nameservers (the delegation), plus glue if a nameserver is inside the zone.
  3. Ask one of your nameservers for www.example.com. It answers authoritatively with the address.

A recursive resolver (the one your ISP or 8.8.8.8 runs) does this walk for you and caches each step by its TTL, so most real-world lookups skip straight to the cached answer.

Why this tool walks the delegation itself

inspect.zone does the walk directly - root, then TLD, then each of your authoritative nameservers - instead of asking a recursive resolver. That is the whole point: a recursive resolver hides which server answered, whether it answered authoritatively, and whether your nameservers agree with each other and with the parent. By querying each server itself, the report can tell you exactly where a problem is, tied to the specific server that produced it. It never uses your system resolver or a public resolver, so its answers are not coloured by someone else's cache.

How this maps to the report

  • Parent checks are about steps 1-2: does the registry delegate your domain, and does its delegation match your zone?
  • NS checks are about step 3's servers: do they all respond, agree, and behave?
  • SOA / MX / WWW / MAIL / CAA / DNSSEC checks read the actual records those authoritative servers return.

See also