Nameserver Migration Check

Enter your domain after changing nameservers. We compare what the registry, your nameservers and public resolvers say, and flag anything left over from the old setup.

Short answer

The nameserver migration check compares the NS records published at the registry (the parent zone), by your own nameservers and by four public resolvers, then asks each nameserver directly whether it answers for the domain. It flags lingering old nameservers, lame delegations, mismatched records and DNSSEC breaks, and explains that cached answers can differ for hours after a move.

Last updated: 2026-10-18

What does a nameserver migration check compare?

A nameserver migration check compares three views of the same list: the delegation held by the registry, the list your own zone publishes, and the cached copies in public resolvers. After a correct move all three agree and every listed server answers for the domain.

Registry (parent zone): the NS list for your domain held by the registry of .com, .net, .org, .ae or another extension. Lookups start here.
Your zone: the NS records your nameservers publish about themselves. They must match the registry list.
Public resolvers: Google, Cloudflare, Quad9 and OpenDNS, which cache answers for the length of the TTL.
Each nameserver, asked directly: does it answer as an authority, with which zone version, and which A, MX and TXT records does it return?
DNSSEC: whether a DS record at the registry still matches the keys your nameservers publish.

The tool follows the delegation from the DNS root, the way a resolver does, so it does not depend on a single cached answer.

How do I move nameservers safely?

Copy the zone to the new provider first, change nameservers second, and delete the old zone last.

Export every record from the old provider: A, AAAA, CNAME, MX, TXT, SRV and any others. Recreate them at the new provider.
Lower the TTL of important records a day or two before the move, for example to 300 seconds.
Enter the domain and the new nameservers in this tool before switching. Check that the new servers answer with the same A, MX and TXT records.
If DNSSEC is enabled, remove the DS record at the registrar first, or add the new provider's DS. A stale DS breaks resolution for validating resolvers.
Change the nameservers at your registrar. For .ae and other country domains the registrar passes the change to the registry.
Run this tool again, with the old nameservers typed in, until the registry, your zone and the resolvers agree.
Keep the old zone running until the old TTL has passed, then delete it.

How do I read the findings?

Errors mean visitors may be affected now, warnings mean a mismatch that will cause intermittent problems, notes explain normal transition effects.

Finding	What it usually means	What to do
Registry still lists old nameservers	The registry list has servers your zone no longer names.	Remove them at the registrar.
Zone names servers the registry lacks	The registrar change is not applied or incomplete.	Enter the same list at the registrar.
Nameserver does not answer for the domain	Lame delegation: refused, timeout or not authoritative.	Load the zone on that server or remove it.
Records differ between servers	One server holds an older or different copy.	Sync the zone; MX and TXT must match.
Resolvers disagree	Some caches still hold the old list.	Wait for the TTL; recheck after 48 hours.
DNSSEC broken	The DS record has no matching key.	Fix the DS at the registrar.

Mail is the usual casualty: if the old and new zones have different MX records, some senders keep delivering to the old mail server. Compare MX and TXT carefully before you switch.

Why do results differ for hours, and what does this tool not see?

Resolvers keep an answer until its TTL runs out, and registries commonly publish NS records with a TTL of many hours, so different networks switch at different times.

A single check cannot show every resolver. The four public resolvers are asked from our server's location; other networks may differ.
Waiting up to about two days for full convergence is normal when the old TTL was long.
Only IPv4 addresses of nameservers are tested.
Registrar status and the history of past changes are not shown.
A, MX and TXT are compared at the zone apex only, not every record.

The tool sends DNS queries to the registry, to the nameservers of your domain and to the old nameservers you type, and only to public addresses. We do not store the domain, the nameservers or the result. For a broken certificate after a move, use the SSL checker; if you need hands-on migration help, see hosting and SSL.

Frequently asked questions

How long does a nameserver change take to propagate?

The registry usually updates within minutes to a few hours, but resolvers keep older answers until their cache expires. NS records at registries often carry a TTL of many hours, so full convergence can take up to about two days. This tool shows which resolvers have already switched and which still hold the old list.

What does it mean when the registry still lists an old nameserver?

It means the delegation held by the registry contains a server that your own zone no longer names. Some resolvers will pick that old server and get stale or no answers, which looks like random failures. Remove the old nameserver in your registrar's settings, but keep its zone alive until caches expire.

Why does my email go missing after a nameserver move?

Usually the old and new zones have different MX records, or the new zone lacks the SPF, DKIM or DMARC TXT records. During the transition some senders still reach the old servers. Copy MX and TXT records exactly before switching, and type the old nameservers into this tool to compare both versions.

How do I find out my old nameservers?

Look in the old provider's control panel, in earlier setup emails, or in the DNS settings at your registrar before you changed them. If the domain is still delegated to them, this tool lists them under the registry result. Type the old names into the optional field to ask them directly whether they still answer.

Can this tool check DNSSEC after a move?

It checks one thing: whether a DS record at the registry matches a key that your nameservers publish. If a DS exists but the new provider publishes no matching key, validating resolvers treat the domain as failing. It does not validate full signatures. Fix it by updating or removing the DS at your registrar.