DNS Trace
This free DNS trace follows a lookup the way the internet does: it asks a root server, then the top-level domain's servers, then the domain's own nameservers, and shows every step, like dig +trace.
Free, no signup.
How a DNS trace works
No single server knows every answer. A root server only knows who runs .com, the .com servers only know which nameservers a domain uses, and only those nameservers hold the actual records.
The trace asks each of them in turn, with no cache in between, and shows who it asked, how long they took and where they sent us next.
Problems a trace finds
A nameserver that's listed at the registry but doesn't answer, or answers without being authoritative (a lame delegation), makes your domain slow or unreachable for some visitors, even when it works for you.
Missing glue is another one: if your nameserver's name is inside your own domain, the parent zone has to publish its address too, or nobody can find it.
After moving a domain
When you change nameservers, a trace shows straight away what the registry now hands out, without waiting for any resolver's cache to expire.
It also shows whether the parent zone publishes a DS record, which means the domain is signed with DNSSEC. If you moved a signed domain, the DS record has to match the new provider's keys.
Frequently asked questions
Why does the trace skip some servers?
If a server doesn't answer within 2.5 seconds, refuses the question or sends something unreadable, we note it and ask the next one, like dig does. A few skips are normal; a step where every server fails is a real problem.
Why does the trace stop at a CNAME?
A CNAME says the name is an alias of another name. Like dig +trace, we show the alias and stop. Run a trace for the target name to follow it.
Is this the same as dig +trace?
It follows the same steps and the raw output uses dig's layout. We ask each server one question without recursion, and use the addresses the parent zone gives us (glue), or look a nameserver up when there are none.
Does it check DNSSEC?
It shows whether the parent zone publishes a DS record for the domain, which means it's signed. To check that the signatures are actually valid, use our DNSSEC checker.
How often can I run a trace?
Each visitor can run 2 traces a minute and 10 an hour. A trace can ask up to 30 servers, so this keeps it fair for everyone.
Do you store the results?
We keep a finished trace for 5 minutes so repeat views are instant, and our server logs which name was traced for 14 days so we can deal with abuse. We don't store your IP address, only a scrambled form of it.
Dig deeper
Dig Online
Ask Cloudflare, Google, Quad9 or your own nameserver, and get dig's full answer: flags, every section and the raw output.
Run digDNS Checker
Look up any record type straight from public DNS, with the live answer and its TTL.
Look up DNSDNSSEC Checker
Checks whether a domain is signed, and whether a broken DS record is making it unreachable.
Check DNSSEC