Nameservers respond over UDP

Essentially every DNS query in the world arrives as a UDP datagram on port 53, so this is the most basic thing that can be asked of a nameserver. The check asks each public address of each delegated nameserver — v4 and v6 counted separately — and records whether an answer came back and how long it took.

A total failure means the domain is dark, and the cause is one of two things: the nameserver hostnames do not resolve to an address, or nothing is listening at the addresses they resolve to. A partial failure is more interesting, because the domain still works. Resolvers try nameservers until one answers, so a dead address does not break resolution — it taxes it, and every visitor whose resolver picks the dead one first waits out a timeout before getting an answer.

Addresses this deployment has no route to are set aside rather than counted. That case is reported as unknown and excluded from the score: an IPv4-only host cannot reach an IPv6-only nameserver, and reporting that as a finding would accuse a working server of being down.

For a dead address, check in this order: does the hostname resolve to the address you expect, is the daemon listening on that specific address rather than on one interface, and does the firewall permit UDP/53 inbound. The middle one catches a surprising share, particularly after a server has been renumbered or moved.

For a decommissioned server, remove it from both places — the delegation at the registrar and the NS record set in the zone. Removing it from one leaves the other advertising it, and resolvers will keep trying it.

If a server answers on IPv4 and not on IPv6, either fix the v6 listener or withdraw the AAAA record. An advertised address that does not answer costs every v6-capable resolver a timeout, which is worse than never having advertised it.