DNS Trace Test Trace DNS From the Root Servers

Trace any DNS lookup from the root servers down to your authoritative name servers, from locations around the world. This free DNS test shows every server asked, every answer and every response time, and whether your name servers agree.

For PTR (reverse) lookups you can enter an IPv4 address.
Test from these locations

Test from these locations

0 of 3 selected

No locations match "".

At a glance

  • Iterative trace: root, then top-level domain (TLD), then your authoritative name servers, with no caching.
  • Every name server, every level: all servers at each level are asked in parallel (all 13 root servers at the top), and disagreements are flagged.
  • Propagation check: shows whether all authoritative name servers return the same answer and whether every location gets the same result.
  • Record types: A, AAAA, CNAME, MX, NS, TXT, SOA, PTR, SRV, CAA, NAPTR and SPF.
  • Custom server: start at a specific name server or public resolver instead of the root.
  • Global: run from up to 3 locations at once without an account.
  • Free: no sign-up required.

How to run a DNS trace

  1. Enter the domain name, such as example.com, or an IPv4 address for a PTR (reverse DNS) lookup.
  2. Choose the record type. A is the default.
  3. Leave DNS server on Default to start at the root servers, or enter your own name server.
  4. Select up to three locations and click Run Test.

How the DNS trace works

A normal DNS lookup asks a caching resolver, which may return an old answer. The DNS trace instead does what a resolver does on a cache miss:

  1. Ask the root servers where the top-level domain (for example .com) is served.
  2. Ask the TLD servers where your domain's name servers are.
  3. Ask your authoritative name servers for the record.

At each level Dotcom-Tools asks every listed name server (up to 13) at the same time, with a 2-second timeout and one retry, falls back to TCP when needed, and follows CNAMEs to the final name. You see each server's IP, response time, result code, flags, referral and records with their TTLs.

How to check DNS propagation

After you change a record or move to new name servers, run the trace from several locations:

  • "Every name server answered and all agree": the change is live on all authoritative servers. Resolvers will pick it up as their cached copies expire (see the TTL).
  • "Not fully propagated: the authoritative name servers disagree": some of your name servers still serve the old data. Check zone transfers or your DNS provider.
  • "Differs from other locations": one location reached a different answer, which points to geo-DNS, anycast differences or a delegation problem.

Troubleshooting failed DNS lookups

  • NXDOMAIN: the name doesn't exist. Check spelling and that the record was created in the right zone.
  • SERVFAIL or timeouts at one level: a name server is down or misconfigured. The trace shows which one.
  • Lame delegation: the TLD points to name servers that don't answer for your domain. Update the NS records at your registrar.
  • Slow lookups: one slow or unreachable name server can delay resolution for everyone. Compare response times per server.

To check your local cache, run ipconfig /displaydns on Windows and compare the IP with the trace result; ipconfig /flushdns clears the cache. nslookup and dig +trace are the command-line equivalents of this test.

Related free tools

To monitor DNS records and name servers continuously with alerts, see Dotcom-Monitor.

Frequently asked questions

What is a DNS trace?

A DNS trace follows a DNS lookup step by step from the root servers through the top-level domain servers to the domain's authoritative name servers, showing each server's answer and response time. It is the online equivalent of dig +trace.

How do I check if my DNS change has propagated?

Run the DNS trace for the changed record from several locations. If every authoritative name server returns the new value and all locations agree, the change is published. Resolvers that cached the old value update when its TTL expires.

How long does DNS propagation take?

Authoritative servers usually update within minutes. Resolvers keep the old answer until its TTL expires, typically 5 minutes to 24 hours. Name server changes at the registrar can take up to 48 hours because TLD records have long TTLs.

How many root DNS servers are there?

There are 13 root server identities, a.root-servers.net through m.root-servers.net, each operated as many anycast instances worldwide. The DNS trace queries all 13.

Which DNS record types can I trace?

A, AAAA, CNAME, MX, NS, TXT, SOA, PTR, SRV, CAA, NAPTR and SPF. Names with underscores, such as _dmarc or SRV records, are supported.

Why is my DNS lookup slow?

Usually one of your name servers is slow or unreachable, or the delegation points to servers that don't answer. The trace shows the response time of every server at every level, so the slow one stands out.

Can I test a specific DNS server?

Yes. Set DNS server to Custom and enter a host name or IPv4 address, such as your authoritative server or a public resolver like 8.8.8.8. Turn off recursion to see the server's own referral.

Last updated: