Why different answers matter
Authoritative nameservers are the servers designated to provide DNS records for a domain. A domain commonly has more than one so that an answer remains available if one server cannot respond. Those servers should generally provide a consistent view of the zone. If one returns a website’s current address while another returns an old address, visitors may reach different destinations depending on which server their resolver asks.
The symptoms can be intermittent: a website loads from one network but not another, or an email-related lookup appears correct in one test and wrong in the next. These symptoms do not prove that authoritative servers disagree. Recursive resolvers cache answers, and devices may use different resolvers. The useful distinction is whether the servers themselves give different responses when asked directly for the same name and record type.
Find the servers to test
Start with the nameservers listed in the domain’s delegation, rather than relying only on an NS lookup answered from within the zone. The delegation is the parent zone’s instruction about where to find the domain. A command such as dig +trace example.com NS can help you follow that path. For a delegated subdomain, use the subdomain you are investigating. If you manage the domain, you can also compare the delegation with the nameservers shown in your registrar or DNS provider settings.
Pay attention to nameserver hostnames that appear in one list but not another. A provider change may leave the parent delegation pointing at a server that no longer hosts the intended zone. Note every delegated server before testing; checking only the server you normally use can hide the disagreement.
Ask each nameserver the same question
Query each delegated server directly, keeping the name, type, and query options identical. For example, if the delegated servers for a domain were ns1.example.net and ns2.example.net, you could run dig @ns1.example.net www.example.com A +norecurse and dig @ns2.example.net www.example.com A +norecurse. Replace those illustrative names with the real servers and name you need to test. Repeat for the relevant type, such as AAAA, MX, TXT, or CNAME.
Compare more than the address in the answer. Check the response code, the answer records, and whether the response has the AA flag, which indicates an authoritative answer. If a name does not exist, inspect the authority section as well: an authoritative negative response can contain an SOA record even when there is no answer record. A timeout or a response without the AA flag is not simply a different zone record; it may mean the server is unreachable or is not authoritative for the name you asked about.
If a nameserver hostname resolves to multiple IP addresses, consider querying each address directly. Likewise, test both IPv4 and IPv6 addresses when applicable. This can reveal a server instance that behaves differently even though it shares a nameserver hostname with healthy instances. Record the server address used alongside each result so the comparison stays clear.
Interpret mismatches carefully
Different A, MX, or TXT records for the same query are strong signs of inconsistent zone data. Different SOA serial numbers can also be a useful clue, particularly after a planned change, but matching serials do not guarantee that all records match. TTL values alone are less decisive: they can vary in cached responses, which is another reason to compare direct authoritative queries.
A mismatch may be temporary while a provider distributes an update among its servers. It may also result from an incomplete migration, a secondary server that has not received a zone transfer, or a delegated server that still serves an older zone. Some DNS setups intentionally tailor answers by location or query context, so document where and how you tested before treating every difference as an error. If the zone uses DNSSEC, failures caused by signing or delegation data may need separate checks; a resolver’s SERVFAIL does not, by itself, show that the authoritative servers contain different records.
Turn the comparison into a fix
Create a small comparison for each affected name: the delegated server, server IP address, record type, response code, AA status, and returned records. Include the SOA serial if available. This gives your DNS provider or domain administrator a specific mismatch to investigate without sharing account credentials or private zone files.
Then check the configuration that controls the differing servers. Confirm that the parent delegation points to the intended nameservers, that each server hosts the correct zone, and that recent edits reached all server instances. After a correction, query every authoritative server again. Recursive resolvers may still return previously cached answers until their cached data expires, so verify the direct answers first and allow for caching when checking whether visitors see the fix.
