Propagation Studio
DNS delegation trace
See exactly how a name is resolved from scratch — the way a resolver with a cold cache does it. We query the root servers, follow each referral down through the TLD to your authoritative nameservers, and show who answered at every step and whether the delegation is signed.
Reading the trace
Each level shows the zone being delegated, the nameserver that answered, and the NS set it handed you on the way down. A DNSSEC tag means that delegation carries a signed DS/RRSIG — the chain of trust is intact at that hop. If the trace stops early or a level returns the wrong nameservers, that's usually a broken delegation or a lame server.
To watch a change roll out across public resolvers worldwide instead, use the propagation checker; for the signed chain in depth, see dnssec.studio.