Check that nameservers are in sync

Why it matters

The nameservers carry different version numbers (SOA serials) for the zone, so at least one has not received the latest changes yet. A short difference right after an update is normal.

The fix

1. Wait a few minutes after an update and check again. Secondary servers need a moment to fetch the new zone.
2. If the difference persists, check zone transfer and NOTIFY between the primary and the secondaries, or re-sync the zone at the second provider.
3. Compare the serial of every server with the command below until they match.

for ns in $(dig NS example.com +short); do
  echo "$ns"; dig +norec @"$ns" SOA example.com +short
done

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Nameservers and delegation check
• Delegate the domain to working nameservers
• Add a second nameserver
• Spread nameservers across more than one network
• Fix nameservers that do not answer for the domain
• Make unreachable nameservers answer, or remove them
• Give each nameserver name an IP address
• Point nameserver names at public IP addresses
• Point nameserver names at A or AAAA records, not CNAMEs
• Make the registrar's nameservers match the zone's NS records
• Make all nameservers publish the same NS records
• Add glue records for nameservers inside your own domain
• Update glue records to match the nameserver's real address