NS lookup

An NS names an authoritative server for the zone (RFC 1035 §3.3.11). The NS name must have addresses of its own, not be an alias (RFC 2181 §10.3). All NS servers should give the same answers.

• NXDOMAIN, NODATA or an error

  NXDOMAIN: the name does not exist. NODATA: the name exists but lacks the type asked (RFC 2308 §2.1, §2.2). Both are definite answers. A timeout or SERVFAIL says nothing about the record, so we show them as "unavailable".

• TTL

  How long the answer may be cached, in seconds; the number shown is what is left in our resolver's cache. Negative answers are cached too, at most for the SOA MINIMUM field (RFC 2308 §4, §5): a newly created record may only appear after it.

• DNSSEC

  "DNSSEC validated" means our resolver checked the signatures and considers the answer authentic (the AD bit, RFC 4035 §3.2.3). "No DNSSEC": the zone is not signed, or the chain of trust does not reach it.

• Aliases (CNAME)

  A CNAME points a name at another, and the resolver follows the chain and answers for its target (RFC 1034 §3.6.2). A name with a CNAME can have no other records, and MX and NS must not point at an alias (RFC 2181 §10.3).

Sources: RFC 1034 · RFC 1035 · RFC 2181 · RFC 2308 · RFC 4035