Your nameservers are serving different versions of the zone
What this check looks for
Your nameservers do not all hold the same copy of your DNS records. Which answer a visitor gets depends on which nameserver their resolver happened to pick.
Why it matters
A change you made is live for some of the internet and not for others, with no pattern anyone can predict or reproduce. It is the hardest class of DNS fault to diagnose from the outside, because every individual lookup looks fine.
When the check passes, your report says: “Every nameserver serves the same version of the zone”.
What it costs your score
When this check fails it removes 8 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.
It shares the dns.health.zone family ceiling of 20 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 8 points
- Family cap
- dns.health.zone · 20
- Category
- DNS
- Module
- Dns health
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Find out why the lagging nameserver is not receiving zone transfers.
Until it catches up, part of the internet is using an older version of your DNS.
Re-test in a few minutes; a difference right after an edit is expected and clears on its own.
If it persists, check the transfer logs on the lagging secondary for a refused or failed AXFR/IXFR.
Confirm the primary's transfer ACL still lists the secondary's current address and that any TSIG key matches.
Force a transfer and confirm the serial matches on every nameserver.
How to confirm it worked
dig +short SOA ‹domain› @<each nameserver> — every serial must be the same
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
The nameservers reported these serials: ‹serial list›. Every authoritative server for a zone should hold the same version; RFC 1912 §2.2 and RFC 1035 §3.3.13 make the serial the mechanism secondaries use to detect a change. A brief difference immediately after an edit is normal and clears within the refresh interval. A persistent one means a transfer is failing — usually an ACL, a TSIG key or a firewall between primary and secondary.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other dns health checks
- A name has a CNAME alongside other records
- A glue record's address does not match the nameserver's own
- A nameserver inside the domain has no glue record
- A nameserver you delegate to does not answer for the zone
- The domain has fewer than two nameservers
- A nameserver name is an alias rather than a host
- The registry and the zone disagree about the nameservers
- All nameservers resolve to one address
- All nameservers sit in one network block
- A nameserver name has no address
- The delegation could not be checked
- A nameserver answers queries for domains that are not yours